CVE-2026-89500

A flaw was found in the Linux kernel's ring-buffer component. When a cached reader page is discarded after a concurrent ring buffer resize, the system may use an incorrect buffer size for memory deallocation. This mismatch can lead to a kernel crash, resulting in a Denial of Service (DoS), or it could cause memory leaks, potentially leading to information disclosure.

A race in the tracing ring buffer can free a cached reader page with an allocation order that no longer matches the order used when the page was allocated. This can happen after a concurrent ring buffer subbuffer resize and may cause either a memory leak or a kernel crash due to an invalid free_pages order. For the CVSS the PR:L is used in the paranoid score because delegated tracefs access or reduced capability admin access may allow a local non root service to trigger tracing operations in some deployments. The issue is not network reachable and requires local interaction with tracing control paths. Impact is at least local denial of service via kernel crash. In the worst still defensible case, freeing pages with the wrong order may corrupt allocator state and may allow confidentiality or integrity impact, so it should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.