CVE-2026-74634 in Linux
Summary
by MITRE • 08/22/2026
In the Linux kernel, the following vulnerability has been resolved:
ring-buffer: Prevent subbuf order change when resizing is disabled
Because ring_buffer_subbuf_order_set() frees buffer pages, we can't allow it when resizing is disabled. A non-consuming reader is at risk of use-after-free (rb_advance_iter()).
Return -EBUSY on resize_disabled, matching ring_buffer_resize() behaviour.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/22/2026
The Linux kernel's tracing subsystem relies heavily on a ring buffer mechanism to capture and store high-frequency events generated by the operating system and applications. This architecture allows for efficient logging without significantly impacting performance, as writers can continue recording data while readers consume it asynchronously. A critical component of this infrastructure is the ability to dynamically adjust the size of these buffers through functions such as ring_buffer_subbuf_order_set. While dynamic resizing provides flexibility in managing memory resources under varying load conditions, it introduces complexity regarding synchronization and state management between producers and consumers of trace data. The vulnerability identified stems from a lack of proper validation when attempting to change the sub-buffer order while the buffer is configured with resizing disabled.
The technical flaw lies in the execution path of ring_buffer_subbuf_order_set(). When this function is invoked, it proceeds to free existing buffer pages to reallocate them according to the new size parameters. However, if the ring buffer has been explicitly locked against resizing via a resize_disabled flag, this deallocation process occurs without adequate safeguards for active readers. Specifically, non-consuming readers that are iterating through the trace data using rb_advance_iter() may hold references or pointers to memory pages that have just been freed by the resizing operation. This creates a classic use-after-free condition where the reader attempts to access memory that is no longer validly allocated within the kernel's address space. Such an error can lead to unpredictable behavior, including kernel panics, data corruption, or potentially exploitable code execution paths if an attacker can influence the state of these freed pages.
From a security and standards perspective, this vulnerability maps directly to CWE-416, which describes Use After Free errors. The exploitation potential is heightened by the fact that ring buffers are often used in high-security contexts such as audit logging or intrusion detection systems where data integrity is paramount. Furthermore, within the context of the MITRE ATT&CK framework, this flaw relates to techniques involving memory corruption and potentially privilege escalation if an unprivileged user can trigger the resize operation on a buffer they are monitoring. The lack of atomicity in checking the resize_disabled state before proceeding with deallocation represents a race condition or logic error that violates fundamental principles of safe resource management in concurrent systems.
The operational impact of this vulnerability is significant for system stability and security integrity. A successful exploitation could result in a denial of service by crashing the kernel, which disrupts all services running on the affected machine. In more severe scenarios, if the freed memory can be reallocated to hold attacker-controlled data before it is accessed again, it may allow for arbitrary code execution with the privileges of the kernel process. This undermines the reliability of security monitoring tools that depend on these trace buffers, potentially allowing malicious activities to go undetected or causing false positives due to corrupted log entries.
To mitigate this risk, the Linux kernel developers have implemented a fix that enforces strict state validation before any structural changes are made to the ring buffer. The updated logic now checks if resizing is disabled and immediately returns an -EBUSY error code if such an attempt is detected. This approach mirrors the behavior of the existing ring_buffer_resize() function, ensuring consistency across the subsystem's API. By preventing the deallocation of pages when resizing is prohibited, the kernel ensures that active iterators retain valid memory references throughout their lifecycle. System administrators and developers should ensure they are running patched versions of the Linux kernel to prevent this specific class of use-after-free vulnerabilities from being triggered in production environments.