UBUNTU-CVE-2026-89500: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Make cpubuffer::freepage a bufferdatareadpage Discarding a cached reader page after a concurrent ring buffer resize uses the new global subbuforder for the freepages() call. This mismatched order may crashes the kernel or leaks memory because the cached page was allocated under the old size. Save the actual freepage order alongside the page address to ensure we always refer to the correct value and do not rely on the potentially stalled cpubuffer->subbuforder value. The simplest is to make freepage a bufferdatareadpage which already covers exactly what we need: a page address and a page order.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The vulnerability is locally exploitable and requires low privileges. It does not require user interaction.
What runtime condition is involved in triggering the flaw?
The issue occurs when a cached ring-buffer reader page is discarded after a concurrent ring-buffer resize. The page may have been allocated using an older sub-buffer order than the order later used to free it.
Which Ubuntu kernel packages are identified as affected?
The affected software listed is ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, ubuntu/linux-hwe-edge, and ubuntu/linux-gkeop.
What could happen if the flaw is triggered?
Using the wrong allocation order when freeing the cached page can crash the kernel or leak memory. The vulnerability is rated high severity with high confidentiality, integrity, and availability impacts in the supplied vector.