CVE-2026-98057

A flaw was found in the Linux kernel's tracing ring buffer. The persistent ring buffer validation logic fails to verify that the recorded sub-buffer count matches the expected page count in the metadata. A local attacker capable of manipulating persistent memory metadata could exploit this issue to induce out-of-bounds memory operations, potentially leading to memory corruption or a Denial of Service (DoS).

A flaw of moderate impact was found in the Linux kernel's tracing ring buffer, affecting the kernel in Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2. The persistent ring buffer validation logic did not verify that the sub-buffer count (nr_subbufs) saved in the persistent metadata matched the expected page count (nr_pages + 1). A local attacker able to manipulate persistent ring buffer metadata could exploit this mismatch to trigger out-of-bounds memory operations when a saved tracing buffer is restored, potentially resulting in memory corruption or a denial of service. Red Hat rated this flaw Moderate severity with a CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), reflecting availability impact only; reliable exploitation requires privileged local control over persistent tracing configuration and reserved memory across reboots, and the available evidence does not establish a strong out-of-bounds write or privilege escalation primitive. Red Hat Enterprise Linux 6, 7, 8, and 9 (including kernel-rt) and the OpenShift Container Platform RHCOS images are not affected because the vulnerable code is not present in their kernels. For the affected Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2 streams, the fix has been deferred to a future scheduled kernel update; the residual risk is limited because exploitation requires local privileged access and a system configured to use the persistent tracing ring buffer feature with reserved memory.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.