{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-89748", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.762Z", "datePublished": "2026-09-11T19:46:53.070Z", "dateUpdated": "2026-09-11T19:46:53.070Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-11T19:46:53.070Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix retry exhaustion in simple ring buffer reader swap\n\nsimple_ring_buffer_swap_reader_page() starts with retry set to 8 and\npost-decrements it only after a failed link replacement. On the final\nattempt, a successful replacement leaves retry at zero, while a failed\nreplacement leaves it at -1.\n\nThe current !retry test reverses both outcomes. It returns an error after\na successful final replacement, leaving the link update complete but the\nreader bookkeeping unfinished. After a failed final replacement, it\nfalls through and updates the head and reader pointers as though the\nreplacement succeeded, which can corrupt the ring.\n\nTreat only a negative counter as exhaustion and return the documented\n-EBUSY error."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/trace/simple_ring_buffer.c"], "versions": [{"version": "34e5b958bdad0f9cf16306368bbc2dc5b2a50143", "lessThan": "df02489aa3aa1834659f0d20c89f7d212047d268", "status": "affected", "versionType": "git"}, {"version": "34e5b958bdad0f9cf16306368bbc2dc5b2a50143", "lessThan": "e0d3aed7b12cf37b74c7cc5265073d0263b49cde", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/trace/simple_ring_buffer.c"], "versions": [{"version": "7.1", "status": "affected"}, {"version": "0", "lessThan": "7.1", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.4", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1", "versionEndExcluding": "7.2.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1", "versionEndExcluding": "7.3-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/df02489aa3aa1834659f0d20c89f7d212047d268"}, {"url": "https://git.kernel.org/stable/c/e0d3aed7b12cf37b74c7cc5265073d0263b49cde"}], "title": "tracing: Fix retry exhaustion in simple ring buffer reader swap", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/trace/simple_ring_buffer.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "df02489aa3aa1834659f0d20c89f7d212047d268", "status": "affected", "version": "34e5b958bdad0f9cf16306368bbc2dc5b2a50143", "versionType": "git"}, {"lessThan": "e0d3aed7b12cf37b74c7cc5265073d0263b49cde", "status": "affected", "version": "34e5b958bdad0f9cf16306368bbc2dc5b2a50143", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/trace/simple_ring_buffer.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "7.1"}, {"lessThan": "7.1", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix retry exhaustion in simple ring buffer reader swap\n\nsimple_ring_buffer_swap_reader_page() starts with retry set to 8 and\npost-decrements it only after a failed link replacement. On the final\nattempt, a successful replacement leaves retry at zero, while a failed\nreplacement leaves it at -1.\n\nThe current !retry test reverses both outcomes. It returns an error after\na successful final replacement, leaving the link update complete but the\nreader bookkeeping unfinished. After a failed final replacement, it\nfalls through and updates the head and reader pointers as though the\nreplacement succeeded, which can corrupt the ring.\n\nTreat only a negative counter as exhaustion and return the documented\n-EBUSY error."}], "id": "CVE-2026-89748", "lastModified": "2026-09-11T20:20:05.643", "metrics": {}, "published": "2026-09-11T20:20:05.643", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/df02489aa3aa1834659f0d20c89f7d212047d268"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e0d3aed7b12cf37b74c7cc5265073d0263b49cde"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux kernel: Ring buffer corruption in tracing due to retry exhaustion", "id": "2532233", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532233"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["A flaw was found in the Linux kernel's tracing subsystem. An issue in the `simple_ring_buffer_swap_reader_page()` function, related to retry exhaustion during ring buffer reader page swaps, can lead to incorrect handling of successful or failed operations. This can result in corruption of the ring buffer, potentially causing system instability or denial of service."], "name": "CVE-2026-89748", "public_date": "2026-09-11T19:46:53Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-89748\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-89748\nhttps://git.kernel.org/stable/c/df02489aa3aa1834659f0d20c89f7d212047d268\nhttps://git.kernel.org/stable/c/e0d3aed7b12cf37b74c7cc5265073d0263b49cde"], "threat_severity": "Moderate"}

{}