UBUNTU-CVE-2026-99160: Medium severity vulnerability
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Do not show buffermeta for CPUs without a buffer The percpu/cpuN/buffermeta files are created for every possible CPU, but buffer->buffers[cpu] is only allocated once that CPU comes online. Reading the file of a CPU that never came online dereferences a NULL cpubuffer in rbmstart(). Fail the open with -ENODEV when the CPU has no buffer, as the other per CPU ring buffer interfaces do.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Make per_cpu/cpuN/buffer_meta fail open with -ENODEV when the CPU has no allocated buffer, preventing rbm_start() from dereferencing a NULL cpu_buffer.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems with per-CPU ring-buffer buffer_meta files for CPUs that are possible but have never come online are exposed when those specific files can be read.
What does an attacker or local user need to do to trigger the fault?
They need to read the per_cpu/cpuN/buffer_meta file for a CPU that has never come online. That read can dereference a NULL cpu_buffer in rbm_start().
Is every buffer_meta file affected?
No. The issue applies to buffer_meta files associated with CPUs that have no allocated ring-buffer instance because they have never been brought online.
What behavior should be expected after the fix?
Opening buffer_meta for a CPU without a buffer should fail with -ENODEV, consistent with the other per-CPU ring-buffer interfaces.