Look up another CVE · open CVE-2026-74634 in the interactive tracker
CVE-2026-74634
ring-buffer: Prevent subbuf order change when resizing is disabled
Published 2026-08-22 (2 months ago) by the Linux kernel CNA. Subsystem kernel/trace. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-74634 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | fixedDSA-6466-1 · 2026-08-25 · text | 6.12.105-1 | Update the kernel and reboot. DSA-6466-1 shipped the fix on 2026-08-25, in 6.12.105-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.9-1 | Update the kernel and reboot. Fixed in 7.1.9-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.9-1 | Update the kernel and reboot. Fixed in 7.1.9-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4788-1 · 2026-09-19 · text | 6.12.107-1~deb12u1 | Update the kernel and reboot. DLA-4788-1 shipped the fix on 2026-09-19, in 6.12.107-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
Because ring_buffer_subbuf_order_set() frees buffer pages, we can't allow it when resizing is disabled. A non-consuming reader is at risk of use-after-free (rb_advance_iter()). Return -EBUSY on resize_disabled, matching ring_buffer_resize() behaviour.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
kernel/trace/ring_buffer.c
- What this is
- TRACINGMAINTAINERS section matched on kernel/trace/ · linux-kernel@vger.kernel.org · Maintained
Check it on the machine
grep -wE 'CONFIG_FUNCTION_TRACER|CONFIG_RETHOOK|CONFIG_RING_BUFFER|CONFIG_TRACEPOINTS|CONFIG_TRACE_CLOCK|CONFIG_TRACING' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.
- bookwormYnot built on arm64/arm64, arm64/cloud-arm64, arm64/rt/arm64, armhf/armmp, armhf/armmp-lpae, armhf/rt/armmp, ppc64el/powerpc64le
- trixieYnot built on arm64/arm64, arm64/arm64-16k, arm64/cloud-arm64, arm64/rt/arm64, armel/rpi, armhf/armmp, armhf/armmp-lpae, armhf/rt/armmp
- forky, sidYnot built on arm64/arm64, arm64/arm64-16k, arm64/cloud-arm64, arm64/rt-arm64, armhf/armmp, armhf/armmp-lpae
- bookworm · linux-6.12Ynot built on arm64/arm64, arm64/arm64-16k, arm64/cloud-arm64, arm64/rt/arm64, armhf/armmp, armhf/armmp-lpae, armhf/rt/armmp
- Y
- built in where it is built at all; some flavours do not build it
- Build switches
- CONFIG_FUNCTION_TRACER, CONFIG_RETHOOK, CONFIG_RING_BUFFER, CONFIG_TRACEPOINTS, CONFIG_TRACE_CLOCK, CONFIG_TRACING
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-22 (2 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.12%, higher than 2.0% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- kernel/trace
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.8 | 6.12.104 | b45b91db4137 |
| 6.8 | 6.18.45 | 62978cf63479 |
| 6.8 | 7.1.9 | 7568e9e717e7 |
| 6.8 | 7.2 | bf98d7b0d5a9 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4788-1 | 2026-09-19 | bookworm 6.12.107-1~deb12u1 | tracker |
| DSA-6466-1 | 2026-08-25 | trixie 6.12.105-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The bug is reached only via local tracefs operations: write() to buffer_subbuf_size_kb (buffer_subbuf_size_write) while a non-consuming ring_buffer_read_start() iterator is active from reading trace/per_cpu/cpuN/trace. No network, adjacent-radio, or physical-device path reaches ring_buffer_subbuf_order_set().
- AC:LAttack complexity, low
- The attacker controls both sides: one thread holds trace open for read (sets resize_disabled via ring_buffer_read_start) while another writes buffer_subbuf_size_kb to free pages still referenced by iter->head_page. rb_advance_iter()/rb_inc_iter then dereferences freed memory; the race is reliably retried.
- PR:LPrivileges required, low
- tracing_check_open_get_tr() enforces only LOCKDOWN_TRACEFS and DAC with no capability check. tracefs buffer_subbuf_size_kb and trace are mode 0640 and are routinely delegated via gid=/mode= to tracing-group members on Android/Perfetto, ChromeOS, and developer systems, matching prior CNA tracefs UAF scores (CVE-2024-50207, CVE-2025-38101).
- UI:NUser interaction, none
- Exploitation uses the attacker's own tracefs file descriptors and threads (open trace for read, write buffer_subbuf_size_kb). No separate victim mount, click, or configuration action is required beyond the attacker holding tracefs access.
- S:UScope, unchanged
- The use-after-free corrupts kernel ring-buffer heap pages and metadata within the same OS security authority. It enables local privilege escalation but does not cross VM, IOMMU, container, or hardware trust boundaries.
- C:HConfidentiality impact, high
- ring_buffer_subbuf_order_set() frees buffer_page data pages while iterators retain head_page pointers; rb_iter_head_event() memcpy() and rb_inc_iter() read iter->head_page->page after free_pages(), leaking recycled kernel heap contents to userspace through trace reads.
- I:HIntegrity impact, high
- Freed sub-buffer pages and buffer_page structures can be reused while iterators and splice paths still perform stores and list operations on them. This UAF heap corruption is exploitable for arbitrary kernel writes and control-flow hijack, not merely a crash.
- A:HAvailability impact, high
- Concurrent page frees with active iterators corrupt ring-buffer lists and cause use-after-free dereferences in rb_advance_iter(), producing kernel oopses/panics. syzbot reported this failure mode and the attacker can retrigger it at will.