EUVD-2026-64571
GHSA-cq5j-7xcv-jwf8
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only vector confirmed by tracefs access requirement; PR:L reflects minimum unprivileged shell needed; high C/I/A reflect kernel use-after-free memory corruption potential.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
ring-buffer: Prevent subbuf order change when resizing is disabled
Because ring_buffer_subbuf_order_set() frees buffer pages, we can't allow it when resizing is disabled. A non-consuming reader is at risk of use-after-free (rb_advance_iter()).
Return -EBUSY on resize_disabled, matching ring_buffer_resize() behaviour.
AnalysisAI
Use-after-free in the Linux kernel's ring-buffer tracing subsystem exposes non-consuming reader iterators to dangling memory when subbuffer order changes occur while resizing is disabled. The vulnerable function ring_buffer_subbuf_order_set() frees buffer pages without checking the resize_disabled flag, leaving rb_advance_iter() holding stale references to freed memory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local system access with at least low-privilege user credentials (confirmed by CVSS PR:L), sufficient to interact with the kernel's tracefs interface (typically /sys/kernel/tracing or /sys/kernel/debug/tracing). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.8 score accurately reflects the potential severity of a kernel use-after-free - high confidentiality, integrity, and availability impact - but real-world exploitation probability is low. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local attacker with a standard unprivileged shell account opens a non-consuming read handle against the kernel ring-buffer tracing interface, establishing an active rb_advance_iter() iterator. The attacker then concurrently triggers ring_buffer_subbuf_order_set() while resizing is disabled, causing the kernel to free the buffer pages still referenced by the iterator. … |
| Remediation | Upgrade to a patched kernel version: 6.12.104, 6.18.45, 7.1.9, or 7.2, as applicable to the deployed stable branch. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Linux systems currently deployed and determine which kernel versions are installed, focusing on production infrastructure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today