CVE-2026-89747

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix use-after-free in trace_pipe read on sub-buffer order change

Writing to buffer_subbuf_size_kb calls ring_buffer_subbuf_order_set(),

which frees every sub-buffer of the ring buffer, including the reader

page, and replaces them with newly allocated ones.

Readers of trace_pipe hold pointers into those pages. ring_buffer_peek()

looks up an event under cpu_buffer->reader_lock but returns the event

pointer after dropping the lock, and peek_next_entry() then calls

ring_buffer_event_length() and ring_buffer_event_data() on it. If the

sub-buffer order is changed in that window, the reader dereferences

freed memory:

BUG: KASAN: use-after-free in ring_buffer_peek+0x3e0/0x430

Read of size 1 at addr ffff88802a4cf010 by task syz-executor989/6002

Freed by:

free_buffer_page kernel/trace/ring_buffer.c:398 [inline]

ring_buffer_subbuf_order_set+0x1325/0x18e0 kernel/trace/ring_buffer.c:7444

buffer_subbuf_s

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References