Impact
The Linux kernel ring‑buffer implementation contains a logic flaw in the remote swap_reader_page callback. When the callback returns -EBUSY, the existing code logs a warning yet still retains the old reader ID and rearranges the page list as though the swap succeeded. This allows the same memory page to be used as both the previous and new reader, creating a race condition that can corrupt kernel memory or trigger a panic, effectively resulting in data corruption or a denial of service.
Affected Systems
All Linux kernel releases that implement the old swap_reader_page logic are affected. This includes every vendor distribution that ships an unpatched kernel prior to the inclusion of the fix referenced in the advisory. Any kernel that has not incorporated the commit from the provided links remains vulnerable.
Risk and Exploitability
The CVSS score of 7.8 indicates high severity. The EPSS score of < 1% suggests a very low but non‑zero likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that exploitation would require an attacker to induce a high‑rate event storm on a small ring buffer, which could be achieved by a privileged user or a compromised local process. No commercial exploit is known, but the potential for data corruption or kernel crash makes the risk significant for systems running an affected kernel.
OpenCVE Enrichment