Skip to main content

Linux Kernel EUVDEUVD-2026-27671

| CVE-2026-43272 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-05-06 Linux GHSA-fwqr-8mv5-j4p7
Denial Of Service Linux Null Pointer Dereference
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local-only trigger (AV:L) with low privilege (PR:L) required to reach tracing validation path; impact is solely kernel crash with no data exposure (C:N/I:N/A:H).

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

3
Analysis Generated
Jul 24, 2026 - 00:44 vuln.today
CVSS changed
May 08, 2026 - 20:07 NVD
5.5 (MEDIUM)
CVE Published
May 06, 2026 - 11:28 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ring-buffer: Fix possible dereference of uninitialized pointer

There is a pointer head_page in rb_meta_validate_events() which is not initialized at the beginning of a function. This pointer can be dereferenced if there is a failure during reader page validation. In this case the control is passed to "invalid" label where the pointer is dereferenced in a loop.

To fix the issue initialize orig_head and head_page before calling rb_validate_buffer.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

AnalysisAI

Uninitialized pointer dereference in the Linux kernel ring-buffer subsystem crashes the kernel, enabling a local low-privileged user to cause a denial of service. The function rb_meta_validate_events() fails to initialize head_page before error-handling code at the invalid label dereferences it during reader page validation failure. No public exploit exists and EPSS places this at the 4th percentile, but vendor-released patches are available in stable branches 6.18.16, 6.19.6, and 7.0.

Technical ContextAI

The Linux kernel's trace ring-buffer subsystem (kernel/trace/ring_buffer.c) manages metadata pages for kernel tracing. The function rb_meta_validate_events() validates ring-buffer reader page structures but neglects to initialize head_page (and orig_head) prior to entering the invalid error-handling label. If validation fails early, the cleanup loop at that label dereferences the uninitialized pointer, producing undefined behavior and typically a kernel panic. This is classified as CWE-476 (NULL Pointer Dereference) and was discovered through static analysis by the Linux Verification Center using the SVACE tool. The CPE cpe:2.3:a:linux:linux:* spans all kernel versions in the affected commit range beginning at 5f3b6e839f3ceb8d6ef02231ba9b5aca71b8bf55. The CONFIG_RING_BUFFER feature, which enables this subsystem, is compiled in by default in virtually all major Linux distributions.

RemediationAI

Upgrade the Linux kernel to a patched stable release: 6.18.16, 6.19.6, or 7.0, corresponding to upstream fix commits bc77986f3cb7476637052edf2d87137fa39f153d, d9942396845fef2369478c157b26738fe07142f6, and f1547779402c4cd67755c33616b7203baa88420b respectively (see https://git.kernel.org/stable/c/bc77986f3cb7476637052edf2d87137fa39f153d and related links). Red Hat and SUSE users should apply kernel updates through their distribution's security channels once backported packages are released. As a compensating control where patching is not immediately possible, restrict access to the tracefs filesystem (e.g., mount with restrictive permissions or limit via kernel lockdown mode) to prevent untrusted local users from exercising the ring-buffer validation path; note this disables kernel tracing observability as a trade-off. Disabling the tracing subsystem at boot via trace_buf_size=0 may also reduce exposure but is not a guaranteed mitigation.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

EUVD-2026-27671 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy