EUVD-2026-76660
GHSA-r5q3-2xvw-rm37
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local low-privilege access required; AC:H because retry exhaustion demands specific concurrent contention; ring corruption gives I:H and A:H, with only marginal stale-data disclosure (C:L).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
tracing: Fix retry exhaustion in simple ring buffer reader swap
simple_ring_buffer_swap_reader_page() starts with retry set to 8 and post-decrements it only after a failed link replacement. On the final attempt, a successful replacement leaves retry at zero, while a failed replacement leaves it at -1.
The current !retry test reverses both outcomes. It returns an error after a successful final replacement, leaving the link update complete but the reader bookkeeping unfinished. After a failed final replacement, it falls through and updates the head and reader pointers as though the replacement succeeded, which can corrupt the ring.
Treat only a negative counter as exhaustion and return the documented -EBUSY error.
AnalysisAI
Ring buffer corruption in the Linux kernel tracing subsystem arises from an inverted retry-exhaustion test in simple_ring_buffer_swap_reader_page(). When a compare-and-swap link replacement succeeds on the eighth and final attempt, the existing !retry guard (which triggers at zero) incorrectly returns -EBUSY while leaving the link update complete but reader bookkeeping unfinished; when all eight attempts fail, retry reaches -1, !retry is false, and the function falls through to update head and reader pointers as though the swap succeeded, silently corrupting the ring buffer structure. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local access to a Linux 7.1-series kernel with the ftrace tracing subsystem active and the simple ring buffer reader in use. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The submitted CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H scores 7.8, which overstates the attack complexity - retry exhaustion requires the swap CAS to fail exactly eight consecutive times, an edge condition dependent on concurrent ring buffer contention or specific scheduling alignment, suggesting AC:H is more accurate. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Linux kernel 7.2.4 or 7.3-rc1, which contain the corrected retry-exhaustion guard in `simple_ring_buffer_swap_reader_page()`. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit your environment to identify all Linux systems running kernel versions before 7.2.4 or 7.3-rc1. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today