DEBIAN-CVE-2026-99160: Debian/linux vulnerability
Published Oct 28, 2026
·Updated
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Do not show buffermeta for CPUs without a buffer The percpu/cpuN/buffermeta files are created for every possible CPU, but buffer->buffers[cpu] is only allocated once that CPU comes online. Reading the file of a CPU that never came online dereferences a NULL cpubuffer in rbmstart(). Fail the open with -ENODEV when the CPU has no buffer, as the other per CPU ring buffer interfaces do.
Affected Software
2 affected components
debian/linux*
debian/linux*
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
For the Linux kernel per_cpu/cpuN/buffer_meta interface, fail opening the file with -ENODEV when the CPU has no allocated buffer, preventing rbm_start() from dereferencing a NULL cpu_buffer.
Event History
Oct 28, 2026
CVE Published
via OSV·11:17 AM
Data Sourced
via OSV·11:17 AM
DescriptionAffected Software