CVE-2026-89503: ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page()
In the Linux kernel, the following vulnerability has been resolved:
ring-buffer: Fix subbuf resize race with ringbufferallocreadpage()
ringbufferallocreadpage() is racy with ringbuffersubbuforderset, it can allocate a reader page with an outdated order. This isn't a big issue, the user can still re-allocate a new reader page and try again.
However, what is more problematic is if the value of subbuforder changes in the middle of ringbufferallocreadpage(). In that case, bpage->order might not match the actual allocated memory.
Use bpage->order for the allocation to prevent this race.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
What condition is required to trigger the race?
The race requires ring_buffer_alloc_read_page() to run while ring_buffer_subbuf_order_set changes the sub-buffer order. If the order changes during allocation, the reader page's recorded order can differ from the memory that was actually allocated.
What is the practical impact if an outdated order is used?
If a reader page is allocated using an outdated order, the user can allocate a new reader page and try again. The more serious case is an order change during allocation, which can leave bpage->order inconsistent with the allocated memory.
How is the issue resolved?
The fix uses bpage->order for the allocation, preventing a mismatch between the page's recorded order and the allocated memory when the sub-buffer order changes concurrently.