CVE-2026-89503 - Vulnerability Details

- ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page()

Description

In the Linux kernel, the following vulnerability has been resolved:

ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page()

ring_buffer_alloc_read_page() is racy with ring_buffer_subbuf_order_set,
it can allocate a reader page with an outdated order. This isn't a big
issue, the user can still re-allocate a new reader page and try again.

However, what is more problematic is if the value of subbuf_order
changes in the middle of ring_buffer_alloc_read_page(). In that case,
bpage->order might not match the actual allocated memory.

Use bpage->order for the allocation to prevent this race.

Published: 2026-09-11

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A race condition exists in the Linux kernel ring buffer subsystem where ring_buffer_alloc_read_page() may allocate a reader page using an outdated subbuf_order value. This can cause bpage->order to mismatch the actual allocated memory, resulting in inconsistencies within or delivering incorrect data to consumers.

Affected Systems

All Linux kernel logic are affected. The fix the patch in future stable releases. Systems running older kernels without this patch remain vulnerable.

Risk and Exploitability

7.8 indicates a high severity. The EPSS score is < 1%, indicating a very low probability of exploitation. No active exploits are reported and the vulnerability is not condition can affect kernel execution; no privileged or user‑space attack path is described in the advisory.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`bce761d757452ba5eb77e11fecc37a04b67494e7`	affected	< 2313ff69bd237aad264a5913907f374f958335a2
`bce761d757452ba5eb77e11fecc37a04b67494e7`	affected	< 2dc510957fe8fd098ab3c3147ebdf34d00cd2734
`bce761d757452ba5eb77e11fecc37a04b67494e7`	affected	< 53106e9262a310ef2c9a9321168c03705940c678
`bce761d757452ba5eb77e11fecc37a04b67494e7`	affected	< e743527c5bfdceda1095bc0a9e596e2aebb6a9c3

Linux

affected

Version	Status	Constraints
`6.8`	affected	—
`0`	unaffected	< 6.8
`6.12.112`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[bce761d757452ba5eb77e11fecc37a04b67494e7,2dc510957fe8fd098ab3c3147ebdf34d00cd2734)`	affected	code_commit	—
`[bce761d757452ba5eb77e11fecc37a04b67494e7,53106e9262a310ef2c9a9321168c03705940c678)`	affected	code_commit	—
`[bce761d757452ba5eb77e11fecc37a04b67494e7,e743527c5bfdceda1095bc0a9e596e2aebb6a9c3)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.8`	affected	generic	—
`[0,6.8)`	unaffected	generic	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a release that contains the patched logic, such as the current stable kernel from the Linux upstream maintainers.
If using a custom kernel build, apply the specific commit that replaces ring_buffer_alloc_read_page() with logic that uses bpage->order for allocation and rebuild the kernel.
Reboot the system after updating to ensure the new kernel code is loaded and active.

Generated by OpenCVE AI on September 15, 2026 at 22:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00173.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/2313ff69bd237aad264a5913907f374f958335a2
https://git.kernel.org/stable/c/2dc510957fe8fd098ab3c3147ebdf34d00cd2734
https://git.kernel.org/stable/c/53106e9262a310ef2c9a9321168c03705940c678
https://git.kernel.org/stable/c/e743527c5bfdceda1095bc0a9e596e2aebb6a9c3
https://nvd.nist.gov/vuln/detail/CVE-2026-89503
https://www.cve.org/CVERecord?id=CVE-2026-89503

History

Sat, 03 Oct 2026 11:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/2313ff69bd237aad264a5913907f374f958335a2

Sun, 13 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-367
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89503 https://www.cve.org/CVERecord?id=CVE-2026-89503
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page() ring_buffer_alloc_read_page() is racy with ring_buffer_subbuf_order_set, it can allocate a reader page with an outdated order. This isn't a big issue, the user can still re-allocate a new reader page and try again. However, what is more problematic is if the value of subbuf_order changes in the middle of ring_buffer_alloc_read_page(). In that case, bpage->order might not match the actual allocated memory. Use bpage->order for the allocation to prevent this race.
Title		ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2dc510957fe8fd098ab3c3147ebdf34d00cd2734 https://git.kernel.org/stable/c/53106e9262a310ef2c9a9321168c03705940c678 https://git.kernel.org/stable/c/e743527c5bfdceda1095bc0a9e596e2aebb6a9c3

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:43:51.357Z

Updated: 2026-10-03T10:56:32.347Z

Reserved: 2026-09-11T19:38:34.715Z

Link: CVE-2026-89503

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:32.547

Modified: 2026-10-03T11:17:42.583

Link: CVE-2026-89503

Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:43:51Z

Links: CVE-2026-89503 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-15T22:30:15Z

Weaknesses

CWE-367
Time-of-check Time-of-use (TOCTOU) Race Condition

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object