Description
In the Linux kernel, the following vulnerability has been resolved:

ring-buffer: Fix false warning in ring_buffer_map_get_reader()

The mmap reader can warn when it catches up with a writer that is still
committing events. rb_get_reader_page() returns NULL in this case, but
ring_buffer_map_get_reader() treats that result as an error.

The initial rb_per_cpu_empty() check filters out an empty buffer, but it
does not guarantee that the next reader page has committed data. Writers
do not take reader_lock and can advance commit_page before publishing the
committed length on the new page. rb_get_reader_page() can swap to that
page, catch up with the writer and return NULL.

Handle NULL through the existing no-data exit without warning. Remove the
caller's reader_page == commit_page check as well, since the reader-page
helper already handles that case. The existing metadata update and return
path remain in place.
Published: 2026-10-28
Score: n/a
EPSS: n/a
KEV: No
Impact: No security impact
Action: Assess
AI Analysis

Impact

The Linux kernel contains a flaw in the ring-buffer subsystem where the function ring_buffer_map_get_reader() incorrectly treats a NULL return from rb_get_reader_page() as an error, issuing a false warning. This bug stems from a race condition between reader and writer threads; the writer may advance the commit page before the reader can confirm the data commit. The flaw does not provide an avenue for malicious exploitation and merely results in an erroneous diagnostic message, posing no risk to confidentiality, integrity, or availability.

Affected Systems

The issue affects the Linux kernel and any distribution that ships a kernel version containing the buggy ring-buffer implementation. Vendors maintaining the kernel; the relevant commits are referenced in the provided Git URLs, albeit exact kernel version numbers are not specified.

Risk and Exploitability

The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no known exploits. Because the flaw produces only a false warning, it does not enable remote code execution, privilege escalation, or denial of service. The likely attack vector—the observation of unnecessary kernel warnings—has no direct security consequence.

Generated by OpenCVE AI on October 28, 2026 at 12:03 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the Linux kernel to a version that includes the patch from commit 029770f5badedc0f0ff85fc45e24785cbbee4a67
  • If no upstream kernel update is available, apply the relevant patch manually from the provided Git references
  • Adjust log verbosity or disable ring-buffer warning handling so that the false warning no longer triggers alerting policies

Generated by OpenCVE AI on October 28, 2026 at 12:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-690

Wed, 28 Oct 2026 10:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix false warning in ring_buffer_map_get_reader() The mmap reader can warn when it catches up with a writer that is still committing events. rb_get_reader_page() returns NULL in this case, but ring_buffer_map_get_reader() treats that result as an error. The initial rb_per_cpu_empty() check filters out an empty buffer, but it does not guarantee that the next reader page has committed data. Writers do not take reader_lock and can advance commit_page before publishing the committed length on the new page. rb_get_reader_page() can swap to that page, catch up with the writer and return NULL. Handle NULL through the existing no-data exit without warning. Remove the caller's reader_page == commit_page check as well, since the reader-page helper already handles that case. The existing metadata update and return path remain in place.
Title ring-buffer: Fix false warning in ring_buffer_map_get_reader()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-28T10:35:11.848Z

Reserved: 2026-09-25T10:25:14.397Z

Link: CVE-2026-99158

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-28T11:17:36.050

Modified: 2026-10-28T11:17:36.050

Link: CVE-2026-99158

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T12:15:14Z

Weaknesses
  • CWE-690

    Unchecked Return Value to NULL Pointer Dereference