EUVD-2026-76405
GHSA-5hxm-7wcj-79fv
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Race condition requires sustained event storm on small buffer (AC:H); local tracing access needed (PR:L); no scope change but all three impact dimensions plausible from page-list corruption.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
ring-buffer: Stop remote reader update when page swap fails
The remote swap_reader_page callback can return -EBUSY when the writer moves the head before the remote catches it, particularly during an event storm on a small buffer. __rb_get_reader_page_from_remote() currently warns about that failure but continues with the unchanged reader ID and rearranges the local page list as though the swap succeeded.
Handle the callback failure as a recoverable error. Report it with pr_warn_ratelimited() and return NULL. Callers already handle a NULL reader page as a failed attempt. This avoids splicing the same page as both the previous and new reader without flooding the log under contention.
AnalysisAI
Page-list corruption in the Linux kernel ring-buffer subsystem allows a local low-privileged attacker to trigger undefined memory behavior by exploiting improper handling of a failed remote reader page swap. When the tracing ring-buffer's swap_reader_page callback returns -EBUSY - which occurs during an event storm on a small buffer - __rb_get_reader_page_from_remote() incorrectly proceeds as though the swap succeeded, splicing the same physical page as both the previous and new reader entry simultaneously. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) local access to the system with at least low-privilege kernel tracing rights - on default configurations of many distributions, this requires `CAP_SYS_ADMIN` or a relaxed `perf_event_paranoid` setting; (2) the ability to configure or target a small ring-buffer (the race window is described as occurring specifically on small buffers); (3) sustained high-frequency event generation sufficient to produce an 'event storm' that causes the writer to advance the buffer head before the remote reader's swap completes. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) overstates real-world exploitability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Linux kernel 7.2.4 or 7.3-rc1 or later, which applies the fix via commits `5eab74874d11` and `a14a97048e48`. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory Linux systems with kernel tracing enabled (check CONFIG_RING_BUFFER and access to /sys/kernel/tracing) and identify which allow unprivileged user access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today