UBUNTU-CVE-2026-89747: Use After Free

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free in tracepipe read on sub-buffer order change Writing to buffersubbufsizekb calls ringbuffersubbuforderset(), which frees every sub-buffer of the ring buffer, including the reader page, and replaces them with newly allocated ones. Readers of tracepipe hold pointers into those pages. ringbufferpeek() looks up an event under cpubuffer->readerlock but returns the event pointer after dropping the lock, and peeknextentry() then calls ringbuffereventlength() and ringbuffereventdata() on it. If the sub-buffer order is changed in that window, the reader dereferences freed memory: BUG: KASAN: use-after-free in ringbufferpeek+0x3e0/0x430 Read of size 1 at addr ffff88802a4cf010 by task syz-executor989/6002 Freed by: freebufferpage kernel/trace/ringbuffer.c:398 [inline] ringbuffersubbuforderset+0x1325/0x18e0 kernel/trace/ringbuffer.c:7444 buffersubbufsizewrite+0x182/0x280 kernel/trace/trace.c:8221 Take traceaccesslock(RINGBUFFERALLCPUS) around the order change. This is the lock tracepipe readers already hold across their entire peek-and-print loop, so the swap can no longer race with a reader that is dereferencing a peeked event.