CVE-2026-97617

A flaw was found in the Linux kernel's ring buffer subsystem. A race condition occurs when updating the buffer configuration concurrently with memory mapping operations. Because the kernel applies the new buffer order before verifying that resizing is permitted across all processors, the system can map out-of-bounds memory pages. A local user could exploit this vulnerability to cause memory corruption or a denial of service (DoS) through a system crash.

A moderate severity race condition flaw was found in the Linux kernel's ring buffer (tracing) subsystem, affecting the kernel in Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2. When ring_buffer_subbuf_order_set() changes the ring buffer sub-buffer order, it stores the new order before walking the CPUs and can return -EBUSY (because a user-mapped buffer has resizing disabled) only after the new order has already been published. Since __rb_map_vma() reads buffer->subbuf_order without holding buffer->mutex, a local user who can map the tracefs ring buffer can race an mmap of an already-mapped CPU buffer against the failing order change, causing the mapping to be sized with the new order and pages to be inserted past the sub-buffer into the VMA. This out-of-bounds mapping can result in memory corruption or a denial of service through a system crash. Red Hat rates the severity of this flaw as Moderate (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

Red Hat Enterprise Linux 6, 7, 8, and 9, and the OpenShift Container Platform CoreOS kernels, are not affected because the vulnerable code is not present in those kernels. Because exploitation requires local access with the ability to map the tracing ring buffer and to win a narrow race window between the mmap and the failing order change, and because the assessed impact is limited to availability with no established confidentiality or integrity impact, the fix for the affected products is deferred to a future planned update. Until the fix is delivered, the residual risk is local memory corruption or denial of service on systems where untrusted local users have access to tracefs ring buffer functionality.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.