CVE-2026-74602: ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer()
In the Linux kernel, the following vulnerability has been resolved:
ring-buffer: Initialise reader page order in rballocatecpubuffer()
In rballocatecpubuffer(), bpage->order was omitted, leaving it as 0. This is an issue for a ring-buffer with subbufs bigger than PAGESIZE if when freed: freebufferpage() relies on this value. Align the value with the actual allocation size (buffer::subbuforder).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In rb_allocate_cpu_buffer(), initialize reader page order (bpage->order) using buffer::subbuf_order instead of leaving it as 0, so that free_buffer_page() uses the correct allocation size.
Linux kernel ring-buffer bpage->order = buffer::subbuf_order
Event History
Frequently Asked Questions
Which systems are affected by this issue?
Systems using the Linux kernel ring buffer with subbuffers larger than PAGE_SIZE are affected. The issue occurs because the reader page order is left at 0 even though the allocation uses buffer::subbuf_order.
When does the faulty state become dangerous?
The problem is relevant when the ring-buffer reader page is freed. free_buffer_page() relies on the stored page order, so an order of 0 does not match a reader page allocated with a larger subbuffer order.
What configuration condition should be checked during triage?
Check whether the affected ring-buffer instance is configured with subbuffers larger than PAGE_SIZE. The provided data does not identify specific kernel versions or a separate workaround.