CVE-2026-89771

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix subbuf resize race with ring buffer readers tracebuffer subbufsize is read lockless in ringbufferreadpage and ringbufferreadstart, while it can simultaneously be resized with ringbuffersubbuforderset. Instead of...

CVE-2026-89503

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix subbuf resize race with ringbufferallocreadpage ringbufferallocreadpage is racy with ringbuffersubbuforderset, it can allocate a reader page with an outdated order. This isn't a big issue, the user can still...

EUVD-2026-76683

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix subbuf resize race with ring buffer readers tracebuffer subbufsize is read lockless in ringbufferreadpage and ringbufferreadstart, while it can simultaneously be resized with ringbuffersubbuforderset. Instead of...

CVE-2026-89771 ring-buffer: Fix subbuf resize race with ring buffer readers

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix subbuf resize race with ring buffer readers tracebuffer subbufsize is read lockless in ringbufferreadpage and ringbufferreadstart, while it can simultaneously be resized with ringbuffersubbuforderset. Instead of...

CVE-2026-89771

CVE-2026-89771 is a race condition in the Linux kernel ring-buffer subsystem. The trace_buffer field subbuf_size is read lockless in ring_buffer_read_page() and ring_buffer_read_start(), while it can be concurrently resized via ring_buffer_subbuf_order_set(). Even with resize_disabled, a race wit...

CVE-2026-89503

CVE-2026-89503 affects the Linux kernel ring-buffer subsystem. A race condition exists between ring_buffer_alloc_read_page() and ring_buffer_subbuf_order_set: if subbuf_order changes during the execution of ring_buffer_alloc_read_page(), the resulting bpage->order may not match the actual allo...

EUVD-2026-76409

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix subbuf resize race with ringbufferallocreadpage ringbufferallocreadpage is racy with ringbuffersubbuforderset, it can allocate a reader page with an outdated order. This isn't a big issue, the user can still...

CVE-2026-89503 ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page()

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix subbuf resize race with ringbufferallocreadpage ringbufferallocreadpage is racy with ringbuffersubbuforderset, it can allocate a reader page with an outdated order. This isn't a big issue, the user can still...

EUVD-2026-76407

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Hold cpubuffer::lock when resizing a subbuf Because, ringbuffersubbuforderset can clear cpubuffer-freepage, hold cpubuffer-lock to prevent races with ringbufferallocreadpage and ringbufferfreereadpage...

CVE-2026-89501 ring-buffer: Hold cpu_buffer::lock when resizing a subbuf

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Hold cpubuffer::lock when resizing a subbuf Because, ringbuffersubbuforderset can clear cpubuffer-freepage, hold cpubuffer-lock to prevent races with ringbufferallocreadpage and ringbufferfreereadpage...

CVE-2026-89501

CVE-2026-89501 affects the Linux kernel ring-buffer subsystem. The vulnerability is a race condition introduced because ring_buffer_subbuf_order_set() can clear cpu_buffer->free_page without holding cpu_buffer->lock, racing with ring_buffer_alloc_read_page() and ring_buffer_free_read_page()...

PT-2026-90217

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Hold cpu buffer::lock when resizing a subbuf Because, ring buffer subbuf order set can clear cpu buffer-free page, hold cpu buffer-lock to prevent races with ring buffer alloc read page and ring buffer free read page...

PT-2026-90487

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix subbuf resize race with ring buffer readers trace buffer subbuf size is read lockless in ring buffer read page and ring buffer read start, while it can simultaneously be resized with ring buffer subbuf order set...