CVE-2026-89503

A flaw was found in the Linux kernel's ring-buffer component. A race condition exists in the ring_buffer_alloc_read_page() function when it interacts with ring_buffer_subbuf_order_set. This can lead to an incorrect memory allocation where the buffer page's order (bpage->order) does not match the actual allocated memory. This mismatch could potentially cause system instability or a denial of service.

A MODERATE severity flaw in the Linux kernel's tracing ring-buffer (kernel/trace/ring_buffer.c) affects the kernel in Red Hat Enterprise Linux 10, where the fix is currently deferred. ring_buffer_alloc_read_page() races with ring_buffer_subbuf_order_set(): if the sub-buffer order changes while a reader page is being allocated, the page's recorded order (bpage->order) may not match the actually allocated memory. A local user with access to the kernel tracing ring buffer could exploit this race to cause system instability or a denial of service. Red Hat rates this flaw MODERATE (CVSS 3.1 score 5.5, availability impact only), lower than the upstream CVEORG rating of 7.8, because the demonstrated consequence is limited to availability with no established confidentiality or integrity impact. While the fix is deferred, residual risk remains a local denial of service, since exploitation requires local access with the ability to use tracing and to change the ring-buffer sub-buffer order. Red Hat Enterprise Linux 6, 7, 8, and 9, and OpenShift Container Platform are not affected because the vulnerable code is not present in their shipped kernel versions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.