GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89499 (GCVE-0-2026-89499)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:43 – Updated: 2026-09-13 06:30
VLAI
Title
ring-buffer: Stop remote reader update when page swap fails
Summary
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Stop remote reader update when page swap fails The remote swap_reader_page callback can return -EBUSY when the writer moves the head before the remote catches it, particularly during an event storm on a small buffer. __rb_get_reader_page_from_remote() currently warns about that failure but continues with the unchanged reader ID and rearranges the local page list as though the swap succeeded. Handle the callback failure as a recoverable error. Report it with pr_warn_ratelimited() and return NULL. Callers already handle a NULL reader page as a failed attempt. This avoids splicing the same page as both the previous and new reader without flooding the log under contention.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 2e67fabd8b77c4f482df9b211bca1b495c6c2c24 , < a14a97048e48471e283d76879b83d2ae323e0722 (git)
Affected: 2e67fabd8b77c4f482df9b211bca1b495c6c2c24 , < 5eab74874d11160725c42ab676ba97a797a362eb (git)
guessed Create a notification for this product.
Linux Linux Affected: 7.1
Unaffected: 0 , < 7.1 (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/ring_buffer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a14a97048e48471e283d76879b83d2ae323e0722",
              "status": "affected",
              "version": "2e67fabd8b77c4f482df9b211bca1b495c6c2c24",
              "versionType": "git"
            },
            {
              "lessThan": "5eab74874d11160725c42ab676ba97a797a362eb",
              "status": "affected",
              "version": "2e67fabd8b77c4f482df9b211bca1b495c6c2c24",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/ring_buffer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "lessThan": "7.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nring-buffer: Stop remote reader update when page swap fails\n\nThe remote swap_reader_page callback can return -EBUSY when the writer\nmoves the head before the remote catches it, particularly during an event\nstorm on a small buffer. __rb_get_reader_page_from_remote() currently\nwarns about that failure but continues with the unchanged reader ID and\nrearranges the local page list as though the swap succeeded.\n\nHandle the callback failure as a recoverable error. Report it with\npr_warn_ratelimited() and return NULL. Callers already handle a NULL reader\npage as a failed attempt. This avoids splicing the same page as both the\nprevious and new reader without flooding the log under contention."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only by a local read of tracefs remotes/*/trace_pipe or remotes/*/trace, which calls ring_buffer_peek/consume then rb_get_reader_page() and __rb_get_reader_page_from_remote(). No network, adjacent-radio, or physical-device path reaches this remote reader swap.\nAC:L - An attacker with tracefs access sets a small remotes/*/buffer_size_kb, enables tracing, generates an event storm via remotes/*/write_event or KVM hyp events, and reads trace_pipe. That is the documented -EBUSY case; the attacker controls writer load and the reader swap, so the failed-swap path is reliably hit.\nPR:L - remotes/ files are mode 0440/0640 and use custom fops with no capable() or tracing_check_open_get_tr() check, only DAC. tracing-gid mounts on Android eng/Perfetto, ChromeOS, and developer kernels grant this to unprivileged users, matching prior CNA tracefs scores.\nUI:N - The attacker opens, configures, and reads their own remotes/*/trace_pipe and related tracefs files. No separate victim mount, click, or other user action is required.\nS:U - The corruption is of host kernel ring-buffer buffer_page lists and reader metadata in the same OS security authority. A host-local tracefs user cannot use this as a VM/IOMMU/guest-to-host escape.\nC:H - On swap failure the kernel still splices the unchanged reader page into the list and shares it with the remote writer. Torn event headers make rb_event_length() return unbounded sizes, and later peeks follow corrupted buffer_page pointers, enabling out-of-bounds kernel reads.\nI:H - __rb_get_reader_page_from_remote() writes list.next/list.prev as if the swap succeeded, creating a self-referential reader and unlinking the real head. Subsequent swaps and rb_inc_page/rb_list_head_clear store further pointers on that corrupted topology, which is exploitable kernel metadata corruption.\nA:H - The failed-swap path hits WARN_ON_ONCE(prev_reader == new_reader), can infinite-loop walking the spliced list, and oopses on corrupted page pointers. panic_on_warn makes those WARNs a kernel panic, and the attacker can retrigger the path at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:30:06.162Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a14a97048e48471e283d76879b83d2ae323e0722"
        },
        {
          "url": "https://git.kernel.org/stable/c/5eab74874d11160725c42ab676ba97a797a362eb"
        }
      ],
      "title": "ring-buffer: Stop remote reader update when page swap fails",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89499",
    "datePublished": "2026-09-11T19:43:48.752Z",
    "dateReserved": "2026-09-11T19:38:34.715Z",
    "dateUpdated": "2026-09-13T06:30:06.162Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89499",
      "date": "2026-09-15",
      "epss": "0.0012",
      "percentile": "0.02098"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89499\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:32.063\",\"lastModified\":\"2026-09-13T07:17:13.100\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nring-buffer: Stop remote reader update when page swap fails\\n\\nThe remote swap_reader_page callback can return -EBUSY when the writer\\nmoves the head before the remote catches it, particularly during an event\\nstorm on a small buffer. __rb_get_reader_page_from_remote() currently\\nwarns about that failure but continues with the unchanged reader ID and\\nrearranges the local page list as though the swap succeeded.\\n\\nHandle the callback failure as a recoverable error. Report it with\\npr_warn_ratelimited() and return NULL. Callers already handle a NULL reader\\npage as a failed attempt. This avoids splicing the same page as both the\\nprevious and new reader without flooding the log under contention.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"kernel/trace/ring_buffer.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2e67fabd8b77c4f482df9b211bca1b495c6c2c24\",\"lessThan\":\"a14a97048e48471e283d76879b83d2ae323e0722\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2e67fabd8b77c4f482df9b211bca1b495c6c2c24\",\"lessThan\":\"5eab74874d11160725c42ab676ba97a797a362eb\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"kernel/trace/ring_buffer.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7.1\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"7.1\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/5eab74874d11160725c42ab676ba97a797a362eb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a14a97048e48471e283d76879b83d2ae323e0722\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-15T05:46:52+00:00",
      "cve": "CVE-2026-89499",
      "id": "CVE-2026-89499",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_not_affected": "276",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ring-buffer: Stop remote reader update when page swap fails",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89499.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-16T00:02:45Z",
      "cve": "CVE-2026-89499",
      "id": "CVE-2026-89499",
      "initial_release_date": "2026-09-12T16:27:27Z",
      "product_status:known_not_affected": "353",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89499",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89499.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.