873 matches found
CVE-2026-89502
A flaw was found in the Linux kernel's ring-buffer component. When sub-buffers are configured with a specific memory allocation order greater than zero, the system attempts to free a memory page using an incorrect size. This memory management error can lead to memory corruption, potentially...
CVE-2026-89501
A flaw was found in the Linux kernel's ring-buffer component. A race condition occurs when resizing a sub-buffer without properly holding the cpubuffer::lock. This oversight can lead to concurrency issues with memory allocation and deallocation operations, potentially resulting in system...
CVE-2026-89748
A flaw was found in the Linux kernel's tracing subsystem. An issue in the simpleringbufferswapreaderpage function, related to retry exhaustion during ring buffer reader page swaps, can lead to incorrect handling of successful or failed operations. This can result in corruption of the ring buffer,...
CVE-2026-89771
A flaw was found in the Linux kernel. A race condition exists in the ring buffer resizing mechanism, where tracebuffer subbufsize can be read without proper locking while it is being simultaneously resized. This could allow a local attacker to trigger unpredictable behavior or a denial of service...
CVE-2026-89503
A flaw was found in the Linux kernel's ring-buffer component. A race condition exists in the ringbufferallocreadpage function when it interacts with ringbuffersubbuforderset. This can lead to an incorrect memory allocation where the buffer page's order bpage-order does not match the actual...
DEBIAN-CVE-2026-89771
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix subbuf resize race with ring buffer readers tracebuffer subbufsize is read lockless in ringbufferreadpage and ringbufferreadstart, while it can simultaneously be resized with ringbuffersubbuforderset. Instead of...
CVE-2026-89771
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix subbuf resize race with ring buffer readers tracebuffer subbufsize is read lockless in ringbufferreadpage and ringbufferreadstart, while it can simultaneously be resized with ringbuffersubbuforderset. Instead of...
DEBIAN-CVE-2026-89748
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix retry exhaustion in simple ring buffer reader swap simpleringbufferswapreaderpage starts with retry set to 8 and post-decrements it only after a failed link replacement. On the final attempt, a successful replacement...
DEBIAN-CVE-2026-89747
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free in tracepipe read on sub-buffer order change Writing to buffersubbufsizekb calls ringbuffersubbuforderset, which frees every sub-buffer of the ring buffer, including the reader page, and replaces them...
CVE-2026-89748
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix retry exhaustion in simple ring buffer reader swap simpleringbufferswapreaderpage starts with retry set to 8 and post-decrements it only after a failed link replacement. On the final attempt, a successful replacement...
CVE-2026-89747
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free in tracepipe read on sub-buffer order change Writing to buffersubbufsizekb calls ringbuffersubbuforderset, which frees every sub-buffer of the ring buffer, including the reader page, and replaces them...
UBUNTU-CVE-2026-89747
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free in tracepipe read on sub-buffer order change Writing to buffersubbufsizekb calls ringbuffersubbuforderset, which frees every sub-buffer of the ring buffer, including the reader page, and replaces them...
CVE-2026-89748
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix retry exhaustion in simple ring buffer reader swap simpleringbufferswapreaderpage starts with retry set to 8 and post-decrements it only after a failed link replacement. On the final attempt, a successful replacement...
CVE-2026-89747
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free in tracepipe read on sub-buffer order change Writing to buffersubbufsizekb calls ringbuffersubbuforderset, which frees every sub-buffer of the ring buffer, including the reader page, and replaces them...
CVE-2026-89771
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix subbuf resize race with ring buffer readers tracebuffer subbufsize is read lockless in ringbufferreadpage and ringbufferreadstart, while it can simultaneously be resized with ringbuffersubbuforderset. Instead of...
UBUNTU-CVE-2026-89771
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix subbuf resize race with ring buffer readers tracebuffer subbufsize is read lockless in ringbufferreadpage and ringbufferreadstart, while it can simultaneously be resized with ringbuffersubbuforderset. Instead of...
UBUNTU-CVE-2026-89748
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix retry exhaustion in simple ring buffer reader swap simpleringbufferswapreaderpage starts with retry set to 8 and post-decrements it only after a failed link replacement. On the final attempt, a successful replacement...
DEBIAN-CVE-2026-89702
In the Linux kernel, the following vulnerability has been resolved: nfsd: size fhverify server sockaddr slot by xptlocallen The nfsdfhverify and nfsdfhverifyerr tracepoints declare the server sockaddr slot sized by xptremotelen but fill it from xptlocal using xptlocallen: TPSTRUCTentry...
CVE-2026-89702
In the Linux kernel, the following vulnerability has been resolved: nfsd: size fhverify server sockaddr slot by xptlocallen The nfsdfhverify and nfsdfhverifyerr tracepoints declare the server sockaddr slot sized by xptremotelen but fill it from xptlocal using xptlocallen: TPSTRUCTentry...
DEBIAN-CVE-2026-89500
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Make cpubuffer::freepage a bufferdatareadpage Discarding a cached reader page after a concurrent ring buffer resize uses the new global subbuforder for the freepages call. This mismatched order may crashes the kernel...