CVE-2026-89748 tracing: Fix retry exhaustion in simple ring buffer reader swap

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix retry exhaustion in simple ring buffer reader swap simpleringbufferswapreaderpage starts with retry set to 8 and post-decrements it only after a failed link replacement. On the final attempt, a successful replacement...

EUVD-2026-76660

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix retry exhaustion in simple ring buffer reader swap simpleringbufferswapreaderpage starts with retry set to 8 and post-decrements it only after a failed link replacement. On the final attempt, a successful replacement...

CVE-2026-89748

CVE-2026-89748 affects the Linux kernel tracing subsystem , specifically the simple_ring_buffer_swap_reader_page() function. The root cause is an off-by-one logic error in the retry counter: the !retry check treats a successful final replacement (retry=0) as a failure and a failed final replaceme...

CVE-2026-89702

CVE-2026-89702 is a Linux kernel vulnerability in the nfsd_fh_verify and nfsd_fh_verify_err tracepoints. These tracepoints declare the server sockaddr slot sized by xpt_remotelen but populate it using xpt_locallen . When xpt_locallen exceeds xpt_remotelen, __assign_sockaddr's memcpy writes past t...

CVE-2026-89702 nfsd: size fh_verify server sockaddr slot by xpt_locallen

In the Linux kernel, the following vulnerability has been resolved: nfsd: size fhverify server sockaddr slot by xptlocallen The nfsdfhverify and nfsdfhverifyerr tracepoints declare the server sockaddr slot sized by xptremotelen but fill it from xptlocal using xptlocallen: TPSTRUCTentry...

CVE-2026-89503

CVE-2026-89503 affects the Linux kernel ring-buffer subsystem. A race condition exists between ring_buffer_alloc_read_page() and ring_buffer_subbuf_order_set: if subbuf_order changes during the execution of ring_buffer_alloc_read_page(), the resulting bpage->order may not match the actual allo...

CVE-2026-89503 ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page()

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix subbuf resize race with ringbufferallocreadpage ringbufferallocreadpage is racy with ringbuffersubbuforderset, it can allocate a reader page with an outdated order. This isn't a big issue, the user can still...

EUVD-2026-76409

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix subbuf resize race with ringbufferallocreadpage ringbufferallocreadpage is racy with ringbuffersubbuforderset, it can allocate a reader page with an outdated order. This isn't a big issue, the user can still...

EUVD-2026-76408

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Free cpubuffer::freepage with subbuforder When sub-buffers use an order greater than 0, cpubuffer-freepage is allocated with subbuforder. Use the correct order for cpubuffer-freepage...

EUVD-2026-76407

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Hold cpubuffer::lock when resizing a subbuf Because, ringbuffersubbuforderset can clear cpubuffer-freepage, hold cpubuffer-lock to prevent races with ringbufferallocreadpage and ringbufferfreereadpage...

CVE-2026-89502

CVE-2026-89502 is a Linux kernel vulnerability in the ring-buffer subsystem. The root cause is that when sub-buffers use a page order greater than 0 , the cpu_buffer->free_page field is allocated using subbuf_order but subsequently freed with the wrong order, leading to an incorrect page relea...

CVE-2026-89501 ring-buffer: Hold cpu_buffer::lock when resizing a subbuf

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Hold cpubuffer::lock when resizing a subbuf Because, ringbuffersubbuforderset can clear cpubuffer-freepage, hold cpubuffer-lock to prevent races with ringbufferallocreadpage and ringbufferfreereadpage...

CVE-2026-89502 ring-buffer: Free cpu_buffer::free_page with subbuf_order

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Free cpubuffer::freepage with subbuforder When sub-buffers use an order greater than 0, cpubuffer-freepage is allocated with subbuforder. Use the correct order for cpubuffer-freepage...

CVE-2026-89501

CVE-2026-89501 affects the Linux kernel ring-buffer subsystem. The vulnerability is a race condition introduced because ring_buffer_subbuf_order_set() can clear cpu_buffer->free_page without holding cpu_buffer->lock, racing with ring_buffer_alloc_read_page() and ring_buffer_free_read_page()...

EUVD-2026-76406

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Make cpubuffer::freepage a bufferdatareadpage Discarding a cached reader page after a concurrent ring buffer resize uses the new global subbuforder for the freepages call. This mismatched order may crashes the kernel...

CVE-2026-89500

CVE-2026-89500 affects the Linux kernel ring-buffer subsystem. The flaw resides in cpu_buffer::free_page: when a cached reader page is discarded after a concurrent ring buffer resize , the free_pages() call uses the new global subbuf_order rather than the order under which the page was originally...

CVE-2026-89500 ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Make cpubuffer::freepage a bufferdatareadpage Discarding a cached reader page after a concurrent ring buffer resize uses the new global subbuforder for the freepages call. This mismatched order may crashes the kernel...

EUVD-2026-76405

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Stop remote reader update when page swap fails The remote swapreaderpage callback can return -EBUSY when the writer moves the head before the remote catches it, particularly during an event storm on a small buffer...

CVE-2026-89499

This Linux kernel vulnerability affects the ring-buffer subsystem. The swap_reader_page remote callback can return -EBUSY when the writer moves the head before the remote reader catches up—particularly during an event storm on a small buffer. The function __rb_get_reader_page_from_remote() previo...

CVE-2026-89499 ring-buffer: Stop remote reader update when page swap fails

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Stop remote reader update when page swap fails The remote swapreaderpage callback can return -EBUSY when the writer moves the head before the remote catches it, particularly during an event storm on a small buffer...