CVE-2026-89501

ring-buffer: Hold cpu_buffer::lock when resizing a subbuf

Published Sep 11, 2026 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

ring-buffer: Hold cpu_buffer::lock when resizing a subbuf

Because, ring_buffer_subbuf_order_set() can clear cpu_buffer->free_page,
hold cpu_buffer->lock to prevent races with
ring_buffer_alloc_read_page() and ring_buffer_free_read_page().

Analysis

Technical impact

A race condition exists in the Linux kernel’s ring‑buffer subsystem. The function ring_buffer_subbuf_order_set() can clear cpu_buffer->free_page, and if the cpu_buffer lock is not held during a resize operation, concurrent ring_buffer_alloc_read_page() or ring_buffer_free_read_page() calls can proceed. This missing lock introduces a classic race condition (CWE‑413) that can lead to corruption of the free_page state, potentially causing a denial of service or data integrity problems.

Affected Systems

The vulnerability affects the Linux kernel; no specific versions were disclosed, so all kernel releases prior to the patch that contain the unchecked ring‑buffer resizing logic are susceptible.

Risk and Exploitability

The CVSS score of 7.8 indicates moderate‑to‑high risk. The EPSS score of <1% indicates a very low probability of exploitation, and the vulnerability is not listed in CISA KEV, suggesting limited evidence of active exploitation. The attack vector is inferred‑access. Because the flaw arises from a missing lock, it is suitable for exploitation only in scenarios where an attacker can influence ring buffer usage.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`8e7b58c27b3c567316a51079b375b846f9223bba`	affected	< 8a496aaa3da6e8d545896c2370c7e617cc931ae2
`8e7b58c27b3c567316a51079b375b846f9223bba`	affected	< 6fcb0b745a0b80df62eae4a93ce52a2d061f4ac2
`8e7b58c27b3c567316a51079b375b846f9223bba`	affected	< bf242baf58de03467f226c8e29554c9495dca7fc
`8e7b58c27b3c567316a51079b375b846f9223bba`	affected	< 24974bd0da1b47fd56c975533ead50abf754e74d

Linux

affected

Version	Status	Constraints
`6.8`	affected	—
`0`	unaffected	< 6.8
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[8e7b58c27b3c567316a51079b375b846f9223bba,8a496aaa3da6e8d545896c2370c7e617cc931ae2)`	affected	code_commit	—
`[8e7b58c27b3c567316a51079b375b846f9223bba,6fcb0b745a0b80df62eae4a93ce52a2d061f4ac2)`	affected	code_commit	—
`[8e7b58c27b3c567316a51079b375b846f9223bba,bf242baf58de03467f226c8e29554c9495dca7fc)`	affected	code_commit	—
`[8e7b58c27b3c567316a51079b375b846f9223bba,24974bd0da1b47fd56c975533ead50abf754e74d)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`6.8`	affected	generic	—
`[0,6.8)`	unaffected	semver	—
`[6.12.109,6.13.0)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest patched Linux kernel release that addresses the ring‑buffer race condition.
If upgrading the kernel immediately is not possible, restrict or disable the use of ring buffer interfaces in subsystems, or disable ring buffers altogether.
Enable kernel integrity or anomaly monitoring to detect unexpected free_page clears or page faults related to ring buffer operations and alert administrators.

Generated by OpenCVE AI on September 15, 2026 at 22:26 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update
Ubuntu USN	USN-9002-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.168% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/24974bd0da1b47fd56c975533ead50abf754e74d
https://git.kernel.org/stable/c/6fcb0b745a0b80df62eae4a93ce52a2d061f4ac2
https://git.kernel.org/stable/c/8a496aaa3da6e8d545896c2370c7e617cc931ae2
https://git.kernel.org/stable/c/bf242baf58de03467f226c8e29554c9495dca7fc
https://nvd.nist.gov/vuln/detail/CVE-2026-89501
https://www.cve.org/CVERecord?id=CVE-2026-89501

History

Sep 13, 2026 6:45 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sep 12, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-413
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89501 https://www.cve.org/CVERecord?id=CVE-2026-89501
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sep 11, 2026 11:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Hold cpu_buffer::lock when resizing a subbuf Because, ring_buffer_subbuf_order_set() can clear cpu_buffer->free_page, hold cpu_buffer->lock to prevent races with ring_buffer_alloc_read_page() and ring_buffer_free_read_page().
Title		ring-buffer: Hold cpu_buffer::lock when resizing a subbuf
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/24974bd0da1b47fd56c975533ead50abf754e74d https://git.kernel.org/stable/c/6fcb0b745a0b80df62eae4a93ce52a2d061f4ac2 https://git.kernel.org/stable/c/8a496aaa3da6e8d545896c2370c7e617cc931ae2 https://git.kernel.org/stable/c/bf242baf58de03467f226c8e29554c9495dca7fc