UBUNTU-CVE-2026-98032: Low severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix subbuf resize races with tracepiperaw readers Concurrent subbuffer resizes may crash tracepiperaw readers or leak uninitialized memory to userspace due to stale size values. Modify ringbufferallocreadpage() to handle the resizing of an existing bufferdatareadpage if necessary and add a new ringbufferreadpagesize(). This new function enables ring-buffer bufferdatareadpage users to not call the racy ringbuffersubbufsizeget(). This makes the sparesize member of ftracebufferinfo redundant. Finally, handle bufferdatareadpage/readerpage order discrepancy in ringbufferreadpage(). On a mismatch simply copy manually the data to the bufferdatareadpage.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which Ubuntu kernel packages are identified as affected?
The listed packages are ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, ubuntu/linux-hwe-edge, and ubuntu/linux-gkeop.
What conditions are involved in triggering the issue?
The issue involves concurrent tracing ring-buffer subbuffer resizing while trace_pipe_raw readers are active. Under those conditions, stale size values can cause a reader crash or expose uninitialized kernel memory to userspace.
What behavior does the fix change?
The fix resizes an existing buffer_data_read_page when needed and introduces ring_buffer_read_page_size() so callers avoid the racy ring_buffer_subbuf_size_get(). It also handles reader-page ordering mismatches by manually copying data into buffer_data_read_page.