CVE-2026-89771

The Linux kernel's tracing ring buffer contains a race condition where ring_buffer_read_page() and ring_buffer_read_start() read trace_buffer::subbuf_size without holding a lock while ring_buffer_subbuf_order_set() can simultaneously resize the sub-buffer order. A local low-privileged attacker who can trigger a trace read concurrent with a buffer resize may cause reads/writes against mismatched buffer sizes, leading to kernel memory corruption. Successful exploitation gives high impact to confidentiality, integrity, and availability (CVSS 3.1: 7.8), potentially enabling privilege escalation or a system crash. Any Linux system running a kernel that contains the vulnerable ring-buffer code is affected. No public proof of concept exists, there is no known exploitation in the wild, and the flaw is not on the CISA KEV list.

What to do: Apply kernel updates as soon as your distribution ships a build containing the upstream fix (which reads bpage::order instead of the removed trace_buffer::subbuf_size and holds the trace_buffer mutex during ring_buffer_read_start()). In the interim, restrict access to tracefs/debugfs tracing interfaces (which control buffer resizing and reading) to root only. Check vendor advisories for backported fixes, since the affected version range was not specified in the source data.