CVE-2026-74634

A flaw was found in the Linux kernel's ring-buffer component. This vulnerability occurs when the system attempts to change the order of sub-buffers while resizing is disabled, leading to memory being freed prematurely. A local attacker could exploit this use-after-free condition to potentially cause a system crash (denial of service) or gain elevated privileges.

A use-after-free can occur in the tracing ring buffer because ring_buffer_subbuf_order_set() may free buffer pages while resizing is disabled and a non-consuming reader can still advance over the old pages in rb_advance_iter(). For the CVSS the PR:L is used in the paranoid score because some systems delegate tracing access to service accounts, tracing groups, containers, or reduced capability root contexts rather than only full host administrators. The issue is local and is not network reachable. The realistic impact is denial of service via kernel crash. In the worst still defensible interpretation, the UAF may allow confidentiality or integrity impact and should be reviewed manually for privilege escalation risk.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.