CVE-2026-98032: tracing: Fix subbuf resize races with trace_pipe_raw readers
In the Linux kernel, the following vulnerability has been resolved:
tracing: Fix subbuf resize races with tracepiperaw readers
Concurrent subbuffer resizes may crash tracepiperaw readers or leak uninitialized memory to userspace due to stale size values.
Modify ringbufferallocreadpage() to handle the resizing of an existing bufferdatareadpage if necessary and add a new ringbufferreadpagesize(). This new function enables ring-buffer bufferdatareadpage users to not call the racy ringbuffersubbufsizeget(). This makes the sparesize member of ftracebufferinfo redundant.
Finally, handle bufferdatareadpage/readerpage order discrepancy in ringbufferreadpage(). On a mismatch simply copy manually the data to the bufferdatareadpage.
Affected Software
Event History
Frequently Asked Questions
What conditions are required for this issue to occur?
The issue requires trace_pipe_raw readers to run concurrently with trace ring-buffer subbuffer resizing. Stale size values during that race can affect readers.
What is the potential impact?
Affected trace_pipe_raw readers may crash, and uninitialized kernel memory may be exposed to userspace.
What can be done while a fix is being deployed?
Avoid concurrent subbuffer resizing while trace_pipe_raw is being read. The referenced stable kernel commits contain the resolved implementation.