CVE-2026-89748

tracing: Fix retry exhaustion in simple ring buffer reader swap

Published Sep 11, 2026 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix retry exhaustion in simple ring buffer reader swap

simple_ring_buffer_swap_reader_page() starts with retry set to 8 and
post-decrements it only after a failed link replacement. On the final
attempt, a successful replacement leaves retry at zero, while a failed
replacement leaves it at -1.

The current !retry test reverses both outcomes. It returns an error after
a successful final replacement, leaving the link update complete but the
reader bookkeeping unfinished. After a failed final replacement, it
falls through and updates the head and reader pointers as though the
replacement succeeded, which can corrupt the ring.

Treat only a negative counter as exhaustion and return the documented
-EBUSY error.

Analysis

Technical impact

The Linux kernel’s simple ring buffer reader swap routine mismanages its retry counter, causing a successful replacement to be reported as an error and a failed replacement to be treated as successful. This erroneous bookkeeping corrupts ring buffer state and may corrupt kernel memory, leading to crashes or other integrity violations. The flaw represents an improper buffer handling vulnerability (CWE-787).

Affected Systems

All Linux kernel versions that have not incorporated the committing change are affected. No specific kernel version range is listed, so any unpatched kernel may be vulnerable, regardless of distribution or patch level.

Risk and Exploitability

The CVSS score of 7.8 indicates high severity, while the EPSS score of less than 1 % indicates a very low likelihood of exploitation at present. The vulnerability is not listed in CISA KEV, but because the flaw resides in core kernel tracing code, it could be triggered by any privileged process that initiates ring‑buffer swap operations. If successfully exploited, memory corruption could lead to kernel panics or provide a foothold for privilege escalation.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`34e5b958bdad0f9cf16306368bbc2dc5b2a50143`	affected	< df02489aa3aa1834659f0d20c89f7d212047d268
`34e5b958bdad0f9cf16306368bbc2dc5b2a50143`	affected	< e0d3aed7b12cf37b74c7cc5265073d0263b49cde

Linux

affected

Version	Status	Constraints
`7.1`	affected	—
`0`	unaffected	< 7.1
`7.2.4`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[34e5b958bdad0f9cf16306368bbc2dc5b2a50143,df02489aa3aa1834659f0d20c89f7d212047d268)`	affected	code_commit	—
`[34e5b958bdad0f9cf16306368bbc2dc5b2a50143,e0d3aed7b12cf37b74c7cc5265073d0263b49cde)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`7.1`	affected	generic	—
`[0,7.1)`	unaffected	generic	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the kernel patch containing the fix referenced in the advisory commits.
Upgrade the kernel to a version that includes the patch, either from a distribution update or by rebuilding the kernel with the updated code.
If an upgrade is not immediately possible, disable kernel tracing or configure the system to avoid operations that trigger ring‑buffer swap logic until the patch is applied.

Generated by OpenCVE AI on September 15, 2026 at 19:53 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.165% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/df02489aa3aa1834659f0d20c89f7d212047d268
https://git.kernel.org/stable/c/e0d3aed7b12cf37b74c7cc5265073d0263b49cde
https://nvd.nist.gov/vuln/detail/CVE-2026-89748
https://www.cve.org/CVERecord?id=CVE-2026-89748

History

Sep 13, 2026 6:45 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 6.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sep 12, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-787
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89748 https://www.cve.org/CVERecord?id=CVE-2026-89748
Metrics	threat_severity `None`	cvssV3_1 `{'score': 6.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H'}` threat_severity `Moderate`

Sep 11, 2026 11:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: tracing: Fix retry exhaustion in simple ring buffer reader swap simple_ring_buffer_swap_reader_page() starts with retry set to 8 and post-decrements it only after a failed link replacement. On the final attempt, a successful replacement leaves retry at zero, while a failed replacement leaves it at -1. The current !retry test reverses both outcomes. It returns an error after a successful final replacement, leaving the link update complete but the reader bookkeeping unfinished. After a failed final replacement, it falls through and updates the head and reader pointers as though the replacement succeeded, which can corrupt the ring. Treat only a negative counter as exhaustion and return the documented -EBUSY error.
Title		tracing: Fix retry exhaustion in simple ring buffer reader swap
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/df02489aa3aa1834659f0d20c89f7d212047d268 https://git.kernel.org/stable/c/e0d3aed7b12cf37b74c7cc5265073d0263b49cde