CVE-2026-89501: ring-buffer: Hold cpu_buffer::lock when resizing a subbuf
In the Linux kernel, the following vulnerability has been resolved:
ring-buffer: Hold cpubuffer::lock when resizing a subbuf
Because, ringbuffersubbuforderset() can clear cpubuffer->freepage, hold cpubuffer->lock to prevent races with ringbufferallocreadpage() and ringbufferfreereadpage().
Affected Software
Event History
Frequently Asked Questions
What condition is required for this race to occur?
The race requires a sub-buffer resize through ring_buffer_subbuf_order_set() while read-page allocation or freeing occurs through ring_buffer_alloc_read_page() or ring_buffer_free_read_page(). The issue arises because resizing can clear cpu_buffer->free_page without holding cpu_buffer::lock.
Which systems are affected by the described issue?
The provided data identifies the Linux kernel as affected. It does not specify affected kernel versions, configurations, or whether any particular default configuration exposes the vulnerable code path.
What is the remediation described by the available information?
The resolved fix is to hold cpu_buffer::lock while resizing a sub-buffer, preventing races with read-page allocation and freeing. The provided references point to stable kernel commits containing the fix.