CVE-2026-80730
Received Received - Intake

Kernel panic in Linux kernel ring buffer cleanup

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix crash passing ERR_PTR to kthread_stop() In test_ringbuffer()'s out_free cleanup loop, the check `!rb_threads[cpu]` only catches NULL entries and misses entries that hold an ERR_PTR. rb_threads[] is static, so unassigned slots are NULL. But when kthread_run_on_cpu() fails for a cpu, it stores ERR_PTR(-ENOMEM) (or -EINTR) in rb_threads[cpu] before the creation loop jumps to out_free. That entry is non-NULL, so the old `!ptr` check does not break, and the cleanup proceeds to call kthread_stop() on the ERR_PTR. kthread_stop() then dereferences the bogus pointer, crashing the kernel during the late_initcall self-test. crash logs: BUG: kernel NULL pointer dereference, address: 000000000000001c Oops: 0002 [#1] SMP NOPTI CPU: 1 PID: 1 Comm: swapper/0 Not tainted 7.2.0-rc6-dirty #7 PREEMPT(lazy) RIP: 0010:kthread_stop+0x2e/0x220 RBX: fffffffffffffff4 CR2: 000000000000001c Call Trace: <TASK> test_ringbuffer+0x1ec/0x650 do_one_initcall+0x6c/0x2c0 kernel_init_freeable+0x21d/0x420 kernel_init+0x15/0x1c0 ret_from_fork+0x21b/0x320 </TASK> Kernel panic - not syncing: Fatal exception

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-13
AI Q&A
2026-09-03
EPSS Evaluated
2026-09-12
NVD
CVE-2026-80730
EUVD
EUVD-2026-70334

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
linux_kernel linux_kernel *
linux_kernel linux_kernel 7.2.0-rc6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability where a cleanup loop incorrectly handles error pointers. When kthread_run_on_cpu() fails, it stores an ERR_PTR in an array. The cleanup loop only checks for NULL entries, missing ERR_PTR values. Calling kthread_stop() on an ERR_PTR causes a kernel crash due to dereferencing an invalid pointer.

Detection Guidance

This vulnerability is specific to the Linux kernel and can be detected by checking kernel crash logs for a NULL pointer dereference in kthread_stop() during late_initcall. Look for crash logs with messages like 'BUG: kernel NULL pointer dereference' or 'kernel panic' related to kthread_stop().

Commands to check: dmesg | grep -i 'NULL pointer dereference' or journalctl -k | grep -i 'kthread_stop'.

Impact Analysis

This vulnerability can cause kernel crashes during system boot or initialization, leading to system instability or unavailability. It specifically affects systems running vulnerable Linux kernel versions during late_initcall self-tests.

Compliance Impact

This vulnerability causes a kernel crash due to a NULL pointer dereference, which could lead to system instability or denial of service. Such crashes may disrupt data processing or availability, potentially violating compliance requirements for availability in standards like GDPR or HIPAA.

Mitigation Strategies

Apply the Linux kernel patch that fixes this issue. Update to a kernel version where the bug is resolved. If using a vulnerable kernel, avoid triggering the test_ringbuffer() function which may cause kernel crashes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80730. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart