CVE-2026-74601

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ring-buffer: Use current_context for safe per-CPU buffer swap

The ring_buffer_swap_cpu() function currently checks the per-CPU

committing counter to determine if a buffer is actively being written to

before performing the swap. However, there exists a race window where

this check can be bypassed:

ring_buffer_lock_reserve

cpu_buffer = buffer->buffers[cpu]; // cpu_buffer_a

rb_reserve_next_event

rb_start_commit // inc committing

if (unlikely(READ_ONCE(cpu_buffer->buffer) != buffer)) {...}

__rb_reserve_next

rb_move_tail

rb_end_commit(cpu_buffer); // dec committing => 0

/* interrupt hits here, successfully swaps! */

local_inc(&cpu_buffer->committing);

ring_buffer_unlock_commit

cpu_buffer = buffer->buffers[cpu]; // cpu_buffer_b

rb_commit

rb_end_co

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References