Description
In the Linux kernel, the following vulnerability has been resolved:

ring-buffer: Stop remote reader update when page swap fails

The remote swap_reader_page callback can return -EBUSY when the writer
moves the head before the remote catches it, particularly during an event
storm on a small buffer. __rb_get_reader_page_from_remote() currently
warns about that failure but continues with the unchanged reader ID and
rearranges the local page list as though the swap succeeded.

Handle the callback failure as a recoverable error. Report it with
pr_warn_ratelimited() and return NULL. Callers already handle a NULL reader
page as a failed attempt. This avoids splicing the same page as both the
previous and new reader without flooding the log under contention.
Published: 2026-09-11
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Data Corruption or Denial of Service
Action: Apply Patch
AI Analysis

Impact

The Linux kernel ring‑buffer implementation contains a logic flaw in the remote swap_reader_page callback. When the callback returns -EBUSY, the existing code logs a warning yet still retains the old reader ID and rearranges the page list as though the swap succeeded. This allows the same memory page to be used as both the previous and new reader, creating a race condition that can corrupt kernel memory or trigger a panic, effectively resulting in data corruption or a denial of service.

Affected Systems

All Linux kernel releases that implement the old swap_reader_page logic are affected. This includes every vendor distribution that ships an unpatched kernel prior to the inclusion of the fix referenced in the advisory. Any kernel that has not incorporated the commit from the provided links remains vulnerable.

Risk and Exploitability

The CVSS score of 7.8 indicates high severity. The EPSS score of < 1% suggests a very low but non‑zero likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that exploitation would require an attacker to induce a high‑rate event storm on a small ring buffer, which could be achieved by a privileged user or a compromised local process. No commercial exploit is known, but the potential for data corruption or kernel crash makes the risk significant for systems running an affected kernel.

Generated by OpenCVE AI on September 13, 2026 at 10:04 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the kernel patch that implements the fix for the ring‑buffer page‑swap failure, using the commits linked in the advisory or upgrading to a kernel version that includes the change
  • If a kernel upgrade cannot be performed, configure the system to monitor for ring‑buffer warning logs; a sudden increase in these warnings indicates stress on the buffer and suggests remediation should be prioritized
  • If disabling the feature is not possible, limit or throttle processes that heavily use remote ring‑buffer interfaces to reduce the probability of an event storm triggering the race condition

Generated by OpenCVE AI on September 13, 2026 at 10:04 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 13 Sep 2026 06:45:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}


Sat, 12 Sep 2026 19:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-362

Sat, 12 Sep 2026 13:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-362

Sat, 12 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-390
References
Metrics threat_severity

None

cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate


Fri, 11 Sep 2026 23:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Stop remote reader update when page swap fails The remote swap_reader_page callback can return -EBUSY when the writer moves the head before the remote catches it, particularly during an event storm on a small buffer. __rb_get_reader_page_from_remote() currently warns about that failure but continues with the unchanged reader ID and rearranges the local page list as though the swap succeeded. Handle the callback failure as a recoverable error. Report it with pr_warn_ratelimited() and return NULL. Callers already handle a NULL reader page as a failed attempt. This avoids splicing the same page as both the previous and new reader without flooding the log under contention.
Title ring-buffer: Stop remote reader update when page swap fails
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-13T06:30:06.162Z

Reserved: 2026-09-11T19:38:34.715Z

Link: CVE-2026-89499

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-11T20:19:32.063

Modified: 2026-09-13T07:17:13.100

Link: CVE-2026-89499

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:43:48Z

Links: CVE-2026-89499 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-13T10:15:18Z

Weaknesses
  • CWE-390

    Detection of Error Condition Without Action