« Volver al listado

CVE-2026-98032

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix subbuf resize races with trace_pipe_raw readers

Concurrent subbuffer resizes may crash trace_pipe_raw readers or leak uninitialized memory to userspace due to stale size values.

Modify ring_buffer_alloc_read_page() to handle the resizing of an existing buffer_data_read_page if necessary and add a new ring_buffer_read_page_size(). This new function enables ring-buffer buffer_data_read_page users to not call the racy ring_buffer_subbuf_size_get(). This makes the spare_size member of ftrace_buffer_info redundant.

Finally, handle buffer_data_read_page/reader_page order discrepancy in ring_buffer_read_page(). On a mismatch simply copy manually the data to the buffer_data_read_page.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-98032",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "bce761d757452ba5eb77e11fecc37a04b67494e7",
              "lessThan": "75b37b8369778b69ce9738d1c97685a1615cb252",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "bce761d757452ba5eb77e11fecc37a04b67494e7",
              "lessThan": "dae8dda341d2d9034a90d59e8a7d502e1263813f",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "include/linux/ring_buffer.h",
            "kernel/trace/ring_buffer.c",
            "kernel/trace/ring_buffer_benchmark.c",
            "kernel/trace/trace.c",
            "kernel/trace/trace.h"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.8",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "include/linux/ring_buffer.h",
            "kernel/trace/ring_buffer.c",
            "kernel/trace/ring_buffer_benchmark.c",
            "kernel/trace/trace.c",
            "kernel/trace/trace.h"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-25T11:17:31.900",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/75b37b8369778b69ce9738d1c97685a1615cb252",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/dae8dda341d2d9034a90d59e8a7d502e1263813f",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix subbuf resize races with trace_pipe_raw readers\n\nConcurrent subbuffer resizes may crash trace_pipe_raw readers or leak\nuninitialized memory to userspace due to stale size values.\n\nModify ring_buffer_alloc_read_page() to handle the resizing of an\nexisting buffer_data_read_page if necessary and add a new\nring_buffer_read_page_size(). This new function enables ring-buffer\nbuffer_data_read_page users to not call the racy\nring_buffer_subbuf_size_get(). This makes the spare_size member of\nftrace_buffer_info redundant.\n\nFinally, handle buffer_data_read_page/reader_page order discrepancy in\nring_buffer_read_page(). On a mismatch simply copy manually the data to\nthe buffer_data_read_page."
    }
  ],
  "lastModified": "2026-09-25T11:17:31.900",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}