« Volver al listado

CVE-2026-89499

Estado: RecibidaAlta (7.8)—

In the Linux kernel, the following vulnerability has been resolved:

ring-buffer: Stop remote reader update when page swap fails

The remote swap_reader_page callback can return -EBUSY when the writer moves the head before the remote catches it, particularly during an event storm on a small buffer. __rb_get_reader_page_from_remote() currently warns about that failure but continues with the unchanged reader ID and rearranges the local page list as though the swap succeeded.

Handle the callback failure as a recoverable error. Report it with pr_warn_ratelimited() and return NULL. Callers already handle a NULL reader page as a failed attempt. This avoids splicing the same page as both the previous and new reader without flooding the log under contention.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad en kernel Linux con AV:L PR:L (acceso local, requiere privilegios) → T1068. Fallo en manejo de buffer ring puede causar DoS (memory corruption) y corrupción de datos mediante condición de carrera en lectura remota.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence ProgramRestrict File and Directory PermissionsRemote Data StorageFilter Network TrafficExecution PreventionEncrypt Sensitive Information

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-89499",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2e67fabd8b77c4f482df9b211bca1b495c6c2c24",
              "lessThan": "a14a97048e48471e283d76879b83d2ae323e0722",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2e67fabd8b77c4f482df9b211bca1b495c6c2c24",
              "lessThan": "5eab74874d11160725c42ab676ba97a797a362eb",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "kernel/trace/ring_buffer.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "7.1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "kernel/trace/ring_buffer.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-11T20:19:32.063",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/5eab74874d11160725c42ab676ba97a797a362eb",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a14a97048e48471e283d76879b83d2ae323e0722",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nring-buffer: Stop remote reader update when page swap fails\n\nThe remote swap_reader_page callback can return -EBUSY when the writer\nmoves the head before the remote catches it, particularly during an event\nstorm on a small buffer. __rb_get_reader_page_from_remote() currently\nwarns about that failure but continues with the unchanged reader ID and\nrearranges the local page list as though the swap succeeded.\n\nHandle the callback failure as a recoverable error. Report it with\npr_warn_ratelimited() and return NULL. Callers already handle a NULL reader\npage as a failed attempt. This avoids splicing the same page as both the\nprevious and new reader without flooding the log under contention."
    }
  ],
  "lastModified": "2026-09-13T07:17:13.100",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}