CVE-2026-89501

A flaw was found in the Linux kernel's ring-buffer component. A race condition occurs when resizing a sub-buffer without properly holding the cpu_buffer::lock. This oversight can lead to concurrency issues with memory allocation and deallocation operations, potentially resulting in system instability or a denial of service.

A race in the tracing ring buffer resize path can occur because ring_buffer_subbuf_order_set clears cpu_buffer free_page without holding cpu_buffer lock. The same free_page pointer is also used by ring_buffer_alloc_read_page and ring_buffer_free_read_page, so concurrent resize and read page operations may corrupt the lifetime state of the ring buffer page. For the CVSS the PR:L is used for the paranoid score because delegated tracing access, container root, or reduced capability service accounts may be able to trigger trace buffer operations without being full system administrators. The issue is local and is not network reachable. Impact is at least denial of service via kernel crash. In the worst case it should be treated as a use after free candidate with possible confidentiality and integrity impact due to racing page pointer ownership.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.