GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-74634 (GCVE-0-2026-74634)

Vulnerability from cvelistv5 – Published: 2026-08-22 15:32 – Updated: 2026-08-25 05:40
VLAI
Title
ring-buffer: Prevent subbuf order change when resizing is disabled
Summary
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Prevent subbuf order change when resizing is disabled Because ring_buffer_subbuf_order_set() frees buffer pages, we can't allow it when resizing is disabled. A non-consuming reader is at risk of use-after-free (rb_advance_iter()). Return -EBUSY on resize_disabled, matching ring_buffer_resize() behaviour.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f9b94daa542a8d2532f0930f01cd9aec2d19621b , < b45b91db41379ee5fb36c187d6d7c37b725cbe8e (git)
Affected: f9b94daa542a8d2532f0930f01cd9aec2d19621b , < 62978cf6347972c04130e4e841ba404504d92b32 (git)
Affected: f9b94daa542a8d2532f0930f01cd9aec2d19621b , < 7568e9e717e7540bd05bcc007f5d76fcaff3cdff (git)
Affected: f9b94daa542a8d2532f0930f01cd9aec2d19621b , < bf98d7b0d5a99991e47e66cee4eb1d3fa514be97 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.8
Unaffected: 0 , < 6.8 (semver)
Unaffected: 6.12.104 , ≤ 6.12.* (semver)
Unaffected: 6.18.45 , ≤ 6.18.* (semver)
Unaffected: 7.1.9 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/ring_buffer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b45b91db41379ee5fb36c187d6d7c37b725cbe8e",
              "status": "affected",
              "version": "f9b94daa542a8d2532f0930f01cd9aec2d19621b",
              "versionType": "git"
            },
            {
              "lessThan": "62978cf6347972c04130e4e841ba404504d92b32",
              "status": "affected",
              "version": "f9b94daa542a8d2532f0930f01cd9aec2d19621b",
              "versionType": "git"
            },
            {
              "lessThan": "7568e9e717e7540bd05bcc007f5d76fcaff3cdff",
              "status": "affected",
              "version": "f9b94daa542a8d2532f0930f01cd9aec2d19621b",
              "versionType": "git"
            },
            {
              "lessThan": "bf98d7b0d5a99991e47e66cee4eb1d3fa514be97",
              "status": "affected",
              "version": "f9b94daa542a8d2532f0930f01cd9aec2d19621b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/ring_buffer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nring-buffer: Prevent subbuf order change when resizing is disabled\n\nBecause ring_buffer_subbuf_order_set() frees buffer pages, we can\u0027t\nallow it when resizing is disabled. A non-consuming reader is at risk of\nuse-after-free (rb_advance_iter()).\n\nReturn -EBUSY on resize_disabled, matching ring_buffer_resize()\nbehaviour."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only via local tracefs operations: write() to buffer_subbuf_size_kb (buffer_subbuf_size_write) while a non-consuming ring_buffer_read_start() iterator is active from reading trace/per_cpu/cpuN/trace. No network, adjacent-radio, or physical-device path reaches ring_buffer_subbuf_order_set().\nAC:L - The attacker controls both sides: one thread holds trace open for read (sets resize_disabled via ring_buffer_read_start) while another writes buffer_subbuf_size_kb to free pages still referenced by iter-\u003ehead_page. rb_advance_iter()/rb_inc_iter then dereferences freed memory; the race is reliably retried.\nPR:L - tracing_check_open_get_tr() enforces only LOCKDOWN_TRACEFS and DAC with no capability check. tracefs buffer_subbuf_size_kb and trace are mode 0640 and are routinely delegated via gid=/mode= to tracing-group members on Android/Perfetto, ChromeOS, and developer systems, matching prior CNA tracefs UAF scores (CVE-2024-50207, CVE-2025-38101).\nUI:N - Exploitation uses the attacker\u0027s own tracefs file descriptors and threads (open trace for read, write buffer_subbuf_size_kb). No separate victim mount, click, or configuration action is required beyond the attacker holding tracefs access.\nS:U - The use-after-free corrupts kernel ring-buffer heap pages and metadata within the same OS security authority. It enables local privilege escalation but does not cross VM, IOMMU, container, or hardware trust boundaries.\nC:H - ring_buffer_subbuf_order_set() frees buffer_page data pages while iterators retain head_page pointers; rb_iter_head_event() memcpy() and rb_inc_iter() read iter-\u003ehead_page-\u003epage after free_pages(), leaking recycled kernel heap contents to userspace through trace reads.\nI:H - Freed sub-buffer pages and buffer_page structures can be reused while iterators and splice paths still perform stores and list operations on them. This UAF heap corruption is exploitable for arbitrary kernel writes and control-flow hijack, not merely a crash.\nA:H - Concurrent page frees with active iterators corrupt ring-buffer lists and cause use-after-free dereferences in rb_advance_iter(), producing kernel oopses/panics. syzbot reported this failure mode and the attacker can retrigger it at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:40:58.185Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b45b91db41379ee5fb36c187d6d7c37b725cbe8e"
        },
        {
          "url": "https://git.kernel.org/stable/c/62978cf6347972c04130e4e841ba404504d92b32"
        },
        {
          "url": "https://git.kernel.org/stable/c/7568e9e717e7540bd05bcc007f5d76fcaff3cdff"
        },
        {
          "url": "https://git.kernel.org/stable/c/bf98d7b0d5a99991e47e66cee4eb1d3fa514be97"
        }
      ],
      "title": "ring-buffer: Prevent subbuf order change when resizing is disabled",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74634",
    "datePublished": "2026-08-22T15:32:14.547Z",
    "dateReserved": "2026-08-15T05:44:03.922Z",
    "dateUpdated": "2026-08-25T05:40:58.185Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74634",
      "date": "2026-09-16",
      "epss": "0.00125",
      "percentile": "0.02546"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74634\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-22T16:16:36.487\",\"lastModified\":\"2026-08-25T06:18:42.647\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nring-buffer: Prevent subbuf order change when resizing is disabled\\n\\nBecause ring_buffer_subbuf_order_set() frees buffer pages, we can\u0027t\\nallow it when resizing is disabled. A non-consuming reader is at risk of\\nuse-after-free (rb_advance_iter()).\\n\\nReturn -EBUSY on resize_disabled, matching ring_buffer_resize()\\nbehaviour.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"kernel/trace/ring_buffer.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"f9b94daa542a8d2532f0930f01cd9aec2d19621b\",\"lessThan\":\"b45b91db41379ee5fb36c187d6d7c37b725cbe8e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f9b94daa542a8d2532f0930f01cd9aec2d19621b\",\"lessThan\":\"62978cf6347972c04130e4e841ba404504d92b32\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f9b94daa542a8d2532f0930f01cd9aec2d19621b\",\"lessThan\":\"7568e9e717e7540bd05bcc007f5d76fcaff3cdff\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f9b94daa542a8d2532f0930f01cd9aec2d19621b\",\"lessThan\":\"bf98d7b0d5a99991e47e66cee4eb1d3fa514be97\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"kernel/trace/ring_buffer.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.104\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.45\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.9\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/62978cf6347972c04130e4e841ba404504d92b32\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7568e9e717e7540bd05bcc007f5d76fcaff3cdff\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b45b91db41379ee5fb36c187d6d7c37b725cbe8e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/bf98d7b0d5a99991e47e66cee4eb1d3fa514be97\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-25T08:52:31+00:00",
      "cve": "CVE-2026-74634",
      "id": "CVE-2026-74634",
      "initial_release_date": "2026-08-22T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ring-buffer: Prevent subbuf order change when resizing is disabled",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74634.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:17:27Z",
      "cve": "CVE-2026-74634",
      "id": "CVE-2026-74634",
      "initial_release_date": "2026-08-23T00:05:35Z",
      "product_status:known_affected": "29",
      "product_status:known_not_affected": "328",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74634",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74634.json",
      "version": "7"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.