GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89503 (GCVE-0-2026-89503)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:43 – Updated: 2026-09-13 06:30
VLAI
Title
ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page()
Summary
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page() ring_buffer_alloc_read_page() is racy with ring_buffer_subbuf_order_set, it can allocate a reader page with an outdated order. This isn't a big issue, the user can still re-allocate a new reader page and try again. However, what is more problematic is if the value of subbuf_order changes in the middle of ring_buffer_alloc_read_page(). In that case, bpage->order might not match the actual allocated memory. Use bpage->order for the allocation to prevent this race.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: bce761d757452ba5eb77e11fecc37a04b67494e7 , < 2dc510957fe8fd098ab3c3147ebdf34d00cd2734 (git)
Affected: bce761d757452ba5eb77e11fecc37a04b67494e7 , < 53106e9262a310ef2c9a9321168c03705940c678 (git)
Affected: bce761d757452ba5eb77e11fecc37a04b67494e7 , < e743527c5bfdceda1095bc0a9e596e2aebb6a9c3 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.8
Unaffected: 0 , < 6.8 (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/ring_buffer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2dc510957fe8fd098ab3c3147ebdf34d00cd2734",
              "status": "affected",
              "version": "bce761d757452ba5eb77e11fecc37a04b67494e7",
              "versionType": "git"
            },
            {
              "lessThan": "53106e9262a310ef2c9a9321168c03705940c678",
              "status": "affected",
              "version": "bce761d757452ba5eb77e11fecc37a04b67494e7",
              "versionType": "git"
            },
            {
              "lessThan": "e743527c5bfdceda1095bc0a9e596e2aebb6a9c3",
              "status": "affected",
              "version": "bce761d757452ba5eb77e11fecc37a04b67494e7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/ring_buffer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page()\n\nring_buffer_alloc_read_page() is racy with ring_buffer_subbuf_order_set,\nit can allocate a reader page with an outdated order. This isn\u0027t a big\nissue, the user can still re-allocate a new reader page and try again.\n\nHowever, what is more problematic is if the value of subbuf_order\nchanges in the middle of ring_buffer_alloc_read_page(). In that case,\nbpage-\u003eorder might not match the actual allocated memory.\n\nUse bpage-\u003eorder for the allocation to prevent this race."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only via local tracefs: read() on per_cpu/*/trace_pipe_raw or snapshot_raw (tracing_buffers_read -\u003e ring_buffer_alloc_read_page) racing with write() to buffer_subbuf_size_kb. No network, adjacent-radio, or physical path reaches this code.\nAC:L - The attacker controls both sides: one thread reads trace_pipe_raw while another writes buffer_subbuf_size_kb. GFP_KERNEL in alloc_cpu_data sleeps, so subbuf_order can change between the two reads in ring_buffer_alloc_read_page(); the race is reliably retried.\nPR:L - tracing_check_open_get_tr() enforces only LOCKDOWN_TRACEFS and DAC with no capable() check. trace_pipe_raw is 0440 and buffer_subbuf_size_kb is 0640, routinely delegated via gid=/mode= to tracing-group members on Android/Perfetto, ChromeOS, and developer systems.\nUI:N - Exploitation uses the attacker\u0027s own tracefs file descriptors and threads. No separate victim mount, click, or configuration action is required beyond the attacker holding tracefs access.\nS:U - Wrong-order page allocation and free corrupt the kernel buddy allocator and ring-buffer pages within the same OS security authority. This enables local privilege escalation but does not cross VM, IOMMU, or hardware trust boundaries.\nC:H - When bpage-\u003eorder does not match the alloc_pages() size, later copy_to_user of a stale page_size and ring_buffer_read_page memcpy/memset over-read adjacent kernel pages, and wrong-order free_pages() corrupts the buddy allocator, yielding arbitrary kernel reads.\nI:H - free_pages() with a larger order than allocated, or memcpy/memset into an undersized sub-buffer when reader_page-\u003eorder later matches the stale bpage-\u003eorder, corrupts adjacent pages and the buddy allocator, which is exploitable for arbitrary kernel writes.\nA:H - Wrong-order free_pages() and out-of-bounds writes on undersized compound pages crash the kernel via buddy-allocator corruption or oops in ring_buffer_read_page/free_read_page. The attacker can retrigger the race at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:30:09.851Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2dc510957fe8fd098ab3c3147ebdf34d00cd2734"
        },
        {
          "url": "https://git.kernel.org/stable/c/53106e9262a310ef2c9a9321168c03705940c678"
        },
        {
          "url": "https://git.kernel.org/stable/c/e743527c5bfdceda1095bc0a9e596e2aebb6a9c3"
        }
      ],
      "title": "ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89503",
    "datePublished": "2026-09-11T19:43:51.357Z",
    "dateReserved": "2026-09-11T19:38:34.715Z",
    "dateUpdated": "2026-09-13T06:30:09.851Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89503",
      "date": "2026-09-16",
      "epss": "0.00161",
      "percentile": "0.05732"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89503\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:32.547\",\"lastModified\":\"2026-09-13T07:17:13.457\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page()\\n\\nring_buffer_alloc_read_page() is racy with ring_buffer_subbuf_order_set,\\nit can allocate a reader page with an outdated order. This isn\u0027t a big\\nissue, the user can still re-allocate a new reader page and try again.\\n\\nHowever, what is more problematic is if the value of subbuf_order\\nchanges in the middle of ring_buffer_alloc_read_page(). In that case,\\nbpage-\u003eorder might not match the actual allocated memory.\\n\\nUse bpage-\u003eorder for the allocation to prevent this race.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"kernel/trace/ring_buffer.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"bce761d757452ba5eb77e11fecc37a04b67494e7\",\"lessThan\":\"2dc510957fe8fd098ab3c3147ebdf34d00cd2734\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bce761d757452ba5eb77e11fecc37a04b67494e7\",\"lessThan\":\"53106e9262a310ef2c9a9321168c03705940c678\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bce761d757452ba5eb77e11fecc37a04b67494e7\",\"lessThan\":\"e743527c5bfdceda1095bc0a9e596e2aebb6a9c3\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"kernel/trace/ring_buffer.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2dc510957fe8fd098ab3c3147ebdf34d00cd2734\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/53106e9262a310ef2c9a9321168c03705940c678\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e743527c5bfdceda1095bc0a9e596e2aebb6a9c3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-14T08:20:09+00:00",
      "cve": "CVE-2026-89503",
      "id": "CVE-2026-89503",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "200",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89503.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T00:58:43Z",
      "cve": "CVE-2026-89503",
      "id": "CVE-2026-89503",
      "initial_release_date": "2026-09-12T16:27:22Z",
      "product_status:known_affected": "17",
      "product_status:known_not_affected": "336",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89503",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89503.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.