EUVD-2026-76409
GHSA-c9wm-w8pc-47gc
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Race condition makes AC:H; tracefs requires low-privilege local access; availability (kernel instability) is the most realistic impact, with partial C:L/I:L from bounded OOB read.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page()
ring_buffer_alloc_read_page() is racy with ring_buffer_subbuf_order_set, it can allocate a reader page with an outdated order. This isn't a big issue, the user can still re-allocate a new reader page and try again.
However, what is more problematic is if the value of subbuf_order changes in the middle of ring_buffer_alloc_read_page(). In that case, bpage->order might not match the actual allocated memory.
Use bpage->order for the allocation to prevent this race.
AnalysisAI
Memory order mismatch in the Linux kernel ring-buffer subsystem exposes a race condition between ring_buffer_alloc_read_page() and ring_buffer_subbuf_order_set() that can corrupt the bpage->order metadata field relative to actual allocated memory size. When subbuf_order changes mid-allocation, subsequent operations using bpage->order to calculate buffer boundaries may read or write outside the allocated slab region, enabling a low-privileged local attacker with access to tracefs/debugfs interfaces to potentially disclose kernel memory contents or destabilize the kernel. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) local system access with read/execute permission to tracefs or debugfs - on most hardened systems this means CAP_SYS_ADMIN or explicit tracefs mount permissions, restricting exploitation to privileged local users; (2) the kernel tracing ring-buffer must be active and in use (e.g., ftrace enabled); (3) concurrent execution of ring_buffer_subbuf_order_set() and ring_buffer_alloc_read_page() - requires either an attacker triggering resize operations directly or racing against a legitimate resize event; (4) kernel version must include the subbuf resize feature (post-commit bce761d75745). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) overstates severity in two respects. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patches are available: upgrade to Linux 7.2.4, 6.18.50, or 7.3-rc1. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Linux systems across your infrastructure and determine which are running kernel versions prior to the patched stable releases containing the ring-buffer fix; simultaneously document which systems have non-root user or service access to tracefs and debugfs interfaces. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today