CVE-2026-74602

A flaw was found in the Linux kernel's ring-buffer component. The rb_allocate_cpu_buffer() function failed to initialize the bpage->order value, leaving it as zero. This uninitialized value is later used by free_buffer_page() when deallocating ring-buffers with sub-buffers larger than a page size. An attacker could potentially exploit this to cause incorrect memory deallocation, leading to system instability or a denial of service (DoS).

This vulnerability is classified as having a Moderate severity because exploitation requires local access, relies on non-default kernel tracing ring-buffer configurations with oversized sub-buffers, and results in a denial of service rather than privilege escalation or code execution. In standard Red Hat deployments, access to the kernel tracing subsystem is restricted to privileged administrators, significantly reducing the unprivileged attack surface. Earlier platforms such as Red Hat Enterprise Linux 8 and 9 do not incorporate the affected sub-buffer implementation and are not impacted.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.