Linux Kernel EUVD-2026-27769

The Linux kernel's ring-buffer tracing subsystem uses rb_read_data_buffer() to validate and recover from potentially corrupted ring buffers, particularly during boot initialization. The vulnerability resides in the kernel's tracing infrastructure (likely in kernel/trace/ring_buffer.c). When processing events from a ring buffer, the function calculates the address of the next event by adding the current event's length to the current event pointer (e + len). If an event's length field is corrupted or maliciously malformed, this pointer arithmetic can reference invalid kernel memory, resulting in out-of-bounds access. The CWE classification is not provided, but the root cause is improper input validation (bounds checking) on untrusted event length metadata before use in pointer calculation. This is a local vector vulnerability requiring authenticated user privileges and logical CPU access.