CVE-2026-89503

Received Received - Intake

Race Condition in Linux Kernel Ring Buffer

Publication date: 2026-09-11

Last updated on: 2026-09-13

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page() ring_buffer_alloc_read_page() is racy with ring_buffer_subbuf_order_set, it can allocate a reader page with an outdated order. This isn't a big issue, the user can still re-allocate a new reader page and try again. However, what is more problematic is if the value of subbuf_order changes in the middle of ring_buffer_alloc_read_page(). In that case, bpage->order might not match the actual allocated memory. Use bpage->order for the allocation to prevent this race.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-13

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-09-30

NVD

CVE-2026-89503

EUVD

EUVD-2026-76409

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a race condition in the ring-buffer subsystem. Specifically, ring_buffer_alloc_read_page() can allocate a reader page with an outdated order value due to a race with ring_buffer_subbuf_order_set. This mismatch between the page order and the actual allocated memory can lead to incorrect behavior.

Detection Guidance

This vulnerability is specific to the Linux kernel's ring buffer implementation and does not have a direct network detection method. Detection involves checking the kernel version and verifying if the vulnerable code path exists. Use uname -a to check your kernel version and grep for ring_buffer_alloc_read_page in kernel source code.

Impact Analysis

The impact is limited but could cause system instability or crashes in scenarios where the ring buffer is heavily used. The user can retry operations, but repeated failures may disrupt performance-critical applications relying on the ring buffer.

Compliance Impact

This vulnerability in the Linux kernel does not directly impact compliance with standards like GDPR or HIPAA. It is a low-risk race condition in the ring buffer subsystem that could cause minor functional issues but does not involve data exposure or integrity violations relevant to these regulations.

Mitigation Strategies

Apply the latest kernel update provided by your Linux distribution to patch the ring buffer race condition. If an update is not immediately available, avoid using ring buffer operations in performance-sensitive contexts until patched.

Hi! I’m here to help you understand CVE-2026-89503. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70