UBUNTU-CVE-2026-89771: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix subbuf resize race with ring buffer readers tracebuffer subbufsize is read lockless in ringbufferreadpage() and ringbufferreadstart(), while it can simultaneously be resized with ringbuffersubbuforderset(). Instead of tracebuffer::subbufsize, use bpage::order in ringbufferreadstart() and ringbufferreadpage(). In ringbufferreadstart(), even with resizedisabled, there is still a possibility of a race with a buffer modification. Hold the tracebuffer mutex to synchronise with any pending ring buffer order modification. tracebuffer::subbufsize is now actually useless, remove it. Also, create accessors rbsubbufcapacity() and rbpagecapacity() which return the actual size available for storing events, while rbsubbufsize() returns the actual subbuf page-size.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Synchronize ring-buffer readers with pending sub-buffer order changes by holding the trace_buffer mutex, use bpage::order instead of trace_buffer::subbuf_size in ring_buffer_read_start() and ring_buffer_read_page(), add rb_subbuf_capacity() and rb_page_capacity() accessors, and remove the now-unused trace_buffer::subbuf_size field.
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The vulnerability has a local attack vector and requires low privileges. No user interaction is required.
What security impact could successful exploitation have?
Successful exploitation could result in high impact to confidentiality, integrity, and availability.
Which Ubuntu kernel packages are listed as affected?
The listed packages are ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, ubuntu/linux-hwe-edge, and ubuntu/linux-gkeop.