Cloudanix VulnDB

CVE-2026-99160

None

CVSS

—

EPSS

0.2%

Published

Oct 28, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel can let local users crash the whole computer by looking at certain performance files for CPUs that were never turned on.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Trivial
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Null pointer dereference in rbm_start() when reading per-CPU buffer_meta files for CPUs that never came online, because cpu_buffer remains unallocated.

Why it matters to the business

Local users can trigger kernel crashes or denial of service on systems with possible but never-online CPUs, leading to unplanned reboots and service disruption.

How an attack unfolds

An attacker with local access opens the buffer_meta file for an offline CPU in the ring buffer tracing interface; the kernel dereferences a NULL cpu_buffer pointer and panics.

How to fix it

Apply the upstream kernel patch that returns -ENODEV for CPUs without an allocated buffer; rebuild and deploy the fixed kernel image across affected systems.

How to confirm the fix worked

Confirm the patch is present by checking that attempts to open buffer_meta for never-online CPUs now return ENODEV instead of crashing; review kernel source for the conditional check before rbm_start().

Typical attack path

  1. Identify a CPU that has never come online on the target system
  2. Open the corresponding per-CPU buffer_meta file under the ring buffer tracing directory
  3. Trigger the NULL dereference in rbm_start() during open or read
  4. Cause kernel panic and system reboot

How to detect it

Search kernel logs for oops or panic messages containing rbm_start, buffer_meta, or NULL pointer dereference in the ring buffer code path; review access attempts to per-CPU tracing files.

What your security team should do

  • Prioritize patching kernel packages on all systems within the next maintenance window
  • Restrict unprivileged access to tracing and debugfs interfaces until patches are applied
  • Monitor for kernel oops or panic events referencing rbm_start or buffer_meta

The record

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Do not show buffer_meta for CPUs without a buffer The per_cpu/cpuN/buffer_meta files are created for every possible CPU, but buffer->buffers[cpu] is only allocated once that CPU comes online. Reading the file of a CPU that never came online dereferences a NULL cpu_buffer in rbm_start(). Fail the open with -ENODEV when the CPU has no buffer, as the other per CPU ring buffer interfaces do.

Affected packages

Ecosystem Package Introduced Fixed