CVE-2026-43210: tracing: ring-buffer: Fix to check event length before using
In the Linux kernel, the following vulnerability has been resolved:
tracing: ring-buffer: Fix to check event length before using
Check the event length before adding it for accessing next index in rbreaddatabuffer(). Since this function is used for validating possibly broken ring buffers, the length of the event could be broken. In that case, the new event (e + len) can point a wrong address. To avoid invalid memory access at boot, check whether the length of each event is in the possible range before using it.
Affected Software
Remediation
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The CVSS vector indicates local access and low privileges are required. No user interaction is required.
What is the likely impact of successful exploitation?
The reported impact is availability only: malformed event length data can lead to invalid memory access, including at boot. The CVSS vector reports no confidentiality or integrity impact.
Is a fix available?
Yes. A patch is available, with fixes referenced in the listed Linux stable kernel commits.