CVE-2026-89771

What it actually does

Race condition in Linux kernel ring-buffer allows lockless reads of trace_buffer::subbuf_size in ring_buffer_read_page() and ring_buffer_read_start() to occur concurrently with resize via ring_buffer_subbuf_order_set(), leading to inconsistent buffer state or memory access violations.

Why it matters to the business

Local attackers on affected systems may trigger kernel crashes, data corruption in tracing buffers, or potential privilege escalation, impacting stability of production Linux workloads that rely on ftrace or similar ring-buffer consumers; low exploitation likelihood reduces immediate urgency.

How an attack unfolds

An attacker with local user privileges enables tracing, starts a reader process calling ring_buffer_read_start or ring_buffer_read_page while simultaneously triggering a subbuffer order change; the race on subbuf_size can be exploited to read invalid memory or bypass resize_disabled protections before the mutex fix.

How to fix it

Update to a Linux kernel version containing the fix that replaces subbuf_size reads with bpage::order, holds the trace_buffer mutex in ring_buffer_read_start, removes the now-unused subbuf_size field, and introduces rb_subbuf_capacity and rb_page_capacity accessors; rebuild and reboot affected systems.

How to confirm the fix worked

Verify kernel source contains the described changes to ring_buffer.c (mutex acquisition, bpage::order usage, removal of subbuf_size); test by exercising resize and read operations under load to confirm absence of races; confirm via kernel version strings post-update.

Typical attack path

1. Obtain local unprivileged access on target Linux system
2. Load or enable kernel tracing that uses ring buffers
3. Concurrently invoke ring_buffer_subbuf_order_set while reader threads execute
4. Trigger inconsistent state to cause denial of service or attempt memory corruption for escalation

How to detect it

Review kernel logs for ring-buffer related warnings, oops, or warnings around resize and read paths; examine ftrace or perf traces for concurrent subbuf modifications; no widespread in-the-wild indicators expected given low EPSS and absence from KEV.

What your security team should do

• Prioritize kernel updates on systems with heavy tracing usage within standard patch windows given flat low EPSS and no KEV listing
• Audit custom tracing configurations for resize operations and consider disabling dynamic subbuf resizing where possible
• Monitor upstream stable kernel releases for backports of the ring-buffer fix