CVE-2026-89502

ring-buffer: Free cpu_buffer::free_page with subbuf_order

Published Sep 11, 2026 CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

ring-buffer: Free cpu_buffer::free_page with subbuf_order

When sub-buffers use an order greater than 0, cpu_buffer->free_page is
allocated with subbuf_order. Use the correct order for
cpu_buffer->free_page.

Analysis

Technical impact

The bug is located in the Linux kernel ring‑buffer implementation. When sub‑buffers are created with an allocation order greater than zero, the deallocation callback cpu_buffer::free_page is intended base order. This mismach between allocation and freeing sizes can corrupt kernel memory or CWE‑763.

Affected Systems

All Linux kernel builds that contain the affected ring‑buffer code are potentially impacted. The description does not specify a particular kernel release; any distribution that has not applied the patch that resolves the incorrect free_page order remains vulnerable.

Risk and Exploitability

With a CVSS base score of 4.4 and an EPSS value below 1 %, the likelihood that this flaw is leveraged in the wild is very low. The vulnerability is absent from the CISA KEV catalog. The flaw concerns a mismatch between allocation and freeing orders in the ring‑buffer module, so an attacker would have to invoke ring-buffer functionality with Based on the description, it is inferred that there is no publicly known or specified attack vector, and the current exploitation probability is minimal.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`f9b94daa542a8d2532f0930f01cd9aec2d19621b`	affected	< 77275ccea06eaf297e8e6ac3fc830cb72086379a
`f9b94daa542a8d2532f0930f01cd9aec2d19621b`	affected	< 8c1ecdcdea738efe0494af908f12c0ae3a97fffa
`f9b94daa542a8d2532f0930f01cd9aec2d19621b`	affected	< 81063bbb16c4fcf0136c9117d5e49d3621dd6a1e
`f9b94daa542a8d2532f0930f01cd9aec2d19621b`	affected	< 234b1a72e9706fe20c08c96f4374ec8e83b934cb

Linux

affected

Version	Status	Constraints
`6.8`	affected	—
`0`	unaffected	< 6.8
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[f9b94daa542a8d2532f0930f01cd9aec2d19621b,77275ccea06eaf297e8e6ac3fc830cb72086379a)`	affected	code_commit	—
`[f9b94daa542a8d2532f0930f01cd9aec2d19621b,8c1ecdcdea738efe0494af908f12c0ae3a97fffa)`	affected	code_commit	—
`[f9b94daa542a8d2532f0930f01cd9aec2d19621b,81063bbb16c4fcf0136c9117d5e49d3621dd6a1e)`	affected	code_commit	—
`[f9b94daa542a8d2532f0930f01cd9aec2d19621b,234b1a72e9706fe20c08c96f4374ec8e83b934cb)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`6.8`	affected	generic	—
`[0,6.8)`	unaffected	generic	—
`[6.12.109,6.12.*]`	unaffected	semver	—
`[6.18.50,6.18.*]`	unaffected	semver	—
`[7.2.4,7.2.*]`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the kernel patch corresponding to commit 234b1a72e9706fe20c08c96f4374ec8e83b934cb to fix the incorrect free_page order.
Disable or reconfigure any ring-buffer features that use sub-buffers with an order greater than zero to avoid exercising the vulnerable code path.
After applying the patch or implementing the configuration change, reboot the system or reload affected modules and monitor system logs for any signs of memory corruption or abnormal deallocation messages.

Generated by OpenCVE AI on September 15, 2026 at 22:26 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DSA	DSA-6528-1	linux security update
Ubuntu USN	USN-9002-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.206% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/234b1a72e9706fe20c08c96f4374ec8e83b934cb
https://git.kernel.org/stable/c/77275ccea06eaf297e8e6ac3fc830cb72086379a
https://git.kernel.org/stable/c/81063bbb16c4fcf0136c9117d5e49d3621dd6a1e
https://git.kernel.org/stable/c/8c1ecdcdea738efe0494af908f12c0ae3a97fffa
https://nvd.nist.gov/vuln/detail/CVE-2026-89502
https://www.cve.org/CVERecord?id=CVE-2026-89502

History

Sep 12, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-763
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89502 https://www.cve.org/CVERecord?id=CVE-2026-89502
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sep 11, 2026 11:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Free cpu_buffer::free_page with subbuf_order When sub-buffers use an order greater than 0, cpu_buffer->free_page is allocated with subbuf_order. Use the correct order for cpu_buffer->free_page.
Title		ring-buffer: Free cpu_buffer::free_page with subbuf_order
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/234b1a72e9706fe20c08c96f4374ec8e83b934cb https://git.kernel.org/stable/c/77275ccea06eaf297e8e6ac3fc830cb72086379a https://git.kernel.org/stable/c/81063bbb16c4fcf0136c9117d5e49d3621dd6a1e https://git.kernel.org/stable/c/8c1ecdcdea738efe0494af908f12c0ae3a97fffa