CVE-2026-74634: ring-buffer: Prevent subbuf order change when resizing is disabled
Published Aug 22, 2026
·Updated
In the Linux kernel, the following vulnerability has been resolved:
ring-buffer: Prevent subbuf order change when resizing is disabled
Because ringbuffersubbuforderset() frees buffer pages, we can't allow it when resizing is disabled. A non-consuming reader is at risk of use-after-free (rbadvanceiter()).
Return -EBUSY on resizedisabled, matching ringbufferresize() behaviour.
Affected Software
1 affected component
Linux Linux kernel
Event History
Aug 22, 2026
CVE Published
via MITRE·03:32 PM
Data Sourced
via MITRE·03:32 PM
DescriptionSeverity
Data Sourced
via NVD·04:16 PM
DescriptionSeverity
Frequently Asked Questions
1
What condition exposes a system to this use-after-free?
The issue requires an attempt to change the ring-buffer subbuffer order while resizing is disabled. A non-consuming reader can then be exposed to freed buffer pages during rb_advance_iter().
2
What behavior indicates that the fix is present?
With resizing disabled, attempts to change the subbuffer order should fail with -EBUSY. This matches the existing behavior of ring_buffer_resize() when resizing is disabled.