EUVD-2026-76683
GHSA-8mw5-wv48-mphh
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Race condition requires precise timing (AC:H); tracefs access needs low privilege (PR:L); all three impact dimensions apply if OOB corruption succeeds.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
ring-buffer: Fix subbuf resize race with ring buffer readers
trace_buffer subbuf_size is read lockless in ring_buffer_read_page() and ring_buffer_read_start(), while it can simultaneously be resized with ring_buffer_subbuf_order_set().
Instead of trace_buffer::subbuf_size, use bpage::order in ring_buffer_read_start() and ring_buffer_read_page().
In ring_buffer_read_start(), even with resize_disabled, there is still a possibility of a race with a buffer modification. Hold the trace_buffer mutex to synchronise with any pending ring buffer order modification.
trace_buffer::subbuf_size is now actually useless, remove it. Also, create accessors rb_subbuf_capacity() and rb_page_capacity() which return the actual size available for storing events, while rb_subbuf_size() returns the actual subbuf page-size.
AnalysisAI
A lockless read race in the Linux kernel's ftrace ring-buffer subsystem allows a local attacker to corrupt kernel memory by concurrently triggering a subbuf resize while a reader accesses stale size metadata. Affected versions span from the commit introducing dynamic subbuf resizing (~Linux 6.8) through current stable branches. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) local system access with at least low-level privilege - specifically, read access to tracefs (e.g., membership in the tracing group, or CAP_SYS_ADMIN in systems not restricting tracefs); (2) the ability to simultaneously invoke ring buffer reads and subbuf resize operations, which requires either two threads or two processes with shared tracing access; (3) kernel versions in the range from approximately Linux 6.8 (where dynamic subbuf resizing was introduced) through the fix boundaries. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N) overstates exploitability: AC:L is incorrect for a timing-dependent race condition; AC:H is more appropriate. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update to a patched kernel: Linux 6.12.x users should upgrade to 6.12.109 or later; 6.18.x users to 6.18.50 or later; 7.2.x users to 7.2.4 or later. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Linux systems running kernel versions 6.8 through current stable branches and review local user access controls to limit potential attack surface. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today