CVE-2026-89499

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The bug is reached only by a local read of tracefs remotes/*/trace_pipe or remotes/*/trace, which calls ring_buffer_peek/consume then rb_get_reader_page() and __rb_get_reader_page_from_remote(). No network, adjacent-radio, or physical-device path reaches this remote reader swap.

AC:LAttack complexity, low

An attacker with tracefs access sets a small remotes/*/buffer_size_kb, enables tracing, generates an event storm via remotes/*/write_event or KVM hyp events, and reads trace_pipe. That is the documented -EBUSY case; the attacker controls writer load and the reader swap, so the failed-swap path is reliably hit.

PR:LPrivileges required, low

remotes/ files are mode 0440/0640 and use custom fops with no capable() or tracing_check_open_get_tr() check, only DAC. tracing-gid mounts on Android eng/Perfetto, ChromeOS, and developer kernels grant this to unprivileged users, matching prior CNA tracefs scores.

UI:NUser interaction, none

The attacker opens, configures, and reads their own remotes/*/trace_pipe and related tracefs files. No separate victim mount, click, or other user action is required.

S:UScope, unchanged

The corruption is of host kernel ring-buffer buffer_page lists and reader metadata in the same OS security authority. A host-local tracefs user cannot use this as a VM/IOMMU/guest-to-host escape.

C:HConfidentiality impact, high

On swap failure the kernel still splices the unchanged reader page into the list and shares it with the remote writer. Torn event headers make rb_event_length() return unbounded sizes, and later peeks follow corrupted buffer_page pointers, enabling out-of-bounds kernel reads.

I:HIntegrity impact, high

__rb_get_reader_page_from_remote() writes list.next/list.prev as if the swap succeeded, creating a self-referential reader and unlinking the real head. Subsequent swaps and rb_inc_page/rb_list_head_clear store further pointers on that corrupted topology, which is exploitable kernel metadata corruption.

A:HAvailability impact, high

The failed-swap path hits WARN_ON_ONCE(prev_reader == new_reader), can infinite-loop walking the spliced list, and oopses on corrupted page pointers. panic_on_warn makes those WARNs a kernel panic, and the attacker can retrigger the path at will.