CVE-2026-80876: Linux Kernel Ring Buffer Length Vulnerability

CVE-2026-80876 Overview

CVE-2026-80876 is a Linux kernel defect in the tracing ring-buffer subsystem. When RB_FORCE_8BYTE_ALIGNMENT is enabled, rb_calculate_event_length() reserves space in event->array[0] to hold the data length, and rb_update_event() writes the length there. However, ring_buffer_event_length() only subtracts the reserved sizeof(event->array[0]) for events larger than RB_MAX_SMALL_DATA + sizeof(event->array[0]). Small events on architectures with RB_FORCE_8BYTE_ALIGNMENT=true therefore report a data length 4 bytes larger than the actual payload. The issue was observed on a riscv64 kernel with CONFIG_HAVE_64BIT_ALIGNED_ACCESS=y while running the ftrace selftest trace_marker_raw.tc.

Critical Impact
Consumers of the tracing ring buffer receive an inflated event length for small events, corrupting downstream parsing of trace data on architectures requiring 8-byte alignment.

Affected Products

Linux kernel builds where RB_FORCE_8BYTE_ALIGNMENT is true
Architectures with CONFIG_HAVE_64BIT_ALIGNED_ACCESS=y (for example, riscv64)
Kernel tracing consumers relying on ring_buffer_event_length() output

Discovery Timeline

2026-09-04 - CVE-2026-80876 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80876

Vulnerability Analysis

The Linux ring-buffer stores each event with a header whose array[0] slot is optionally used to encode the data length. When RB_FORCE_8BYTE_ALIGNMENT is enabled, the reservation logic in rb_calculate_event_length() unconditionally adds 4 bytes for sizeof(event->array[0]) so that the data length field can be stored while preserving 8-byte alignment. rb_update_event() then writes the length value into that reserved slot.

The reader-side helper ring_buffer_event_length() is asymmetric. It only strips the reserved sizeof(event->array[0]) for events whose payload exceeds RB_MAX_SMALL_DATA + sizeof(event->array[0]). Small events therefore return a length that is 4 bytes larger than the actual payload written into the buffer.

The defect manifests as trace data misalignment. On riscv64, the ftrace selftest trace_marker_raw.tc produced consistent 8*N data-field sizes for event ids 1–100 and switched to 8*N+4 once the id exceeded 100. The patch adds RB_FORCE_8BYTE_ALIGNMENT as a condition to subtract the length-field size whenever the alignment flag is enabled, restoring a consistent reported length across small and large events.

Root Cause

The root cause is an inconsistent accounting rule between the writer path and the reader path in the ring-buffer implementation. rb_calculate_event_length() reserves the array[0] slot unconditionally when RB_FORCE_8BYTE_ALIGNMENT is true, but ring_buffer_event_length() only compensates for that reservation when the event exceeds RB_MAX_SMALL_DATA. The mismatch is a boundary condition error in event length calculation.

Attack Vector

This is a functional correctness defect in the kernel tracing subsystem rather than a remotely reachable memory-safety flaw. Impact is limited to processes and tools that read the tracing ring buffer, such as ftrace, perf, and userspace trace parsers, on affected architectures. Incorrect reported lengths can cause trace records to be misparsed, leading to broken observability and unreliable forensic data during incident response. No exploit is publicly available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

The kernel commits addressing the issue are available in the upstream stable tree. See the Kernel Git Commit 3a63a118 and companion patches 14057268, 24c3fa71, 7c9f0ccf, c37e0a4b, cfada73f, dbcb8635, and ec5e96ae for the full backport series.

Detection Methods for CVE-2026-80876

Indicators of Compromise

Ftrace trace_marker_raw.tc selftest producing inconsistent data field sizes that alternate between 8*N and 8*N+4 bytes across event ids.
Userspace trace parsers reporting record misalignment or spurious 4-byte trailing bytes on riscv64 or other CONFIG_HAVE_64BIT_ALIGNED_ACCESS=y builds.
Kernel builds containing the pre-patch versions of rb_calculate_event_length() and ring_buffer_event_length() in kernel/trace/ring_buffer.c.

Detection Strategies

Inventory Linux hosts and identify kernels compiled with RB_FORCE_8BYTE_ALIGNMENT true, especially riscv64 systems with CONFIG_HAVE_64BIT_ALIGNED_ACCESS=y.
Run the upstream ftrace selftest suite, including trace_marker_raw.tc, and validate that reported data field sizes remain consistent across event ids.
Compare running kernel commit hashes against the fix commits listed in the upstream stable tree to confirm the patch is present.

Monitoring Recommendations

Monitor kernel package versions across the fleet and alert on hosts lagging behind the stable release that contains the fix.
Track failures or anomalies in tracing pipelines (ftrace, perf, trace-cmd) that could indicate malformed event records.
Audit configuration drift on tracing-enabled hosts to ensure trace consumers have not been silently disabled to hide parsing errors.

How to Mitigate CVE-2026-80876

Immediate Actions Required

Apply the upstream stable kernel update containing the ring-buffer length fix on all affected architectures.
Prioritize patching riscv64 hosts and any build with CONFIG_HAVE_64BIT_ALIGNED_ACCESS=y, as they are the confirmed impact scope.
Rebuild and redeploy custom kernels that carry local backports of the tracing subsystem to include the corrected ring_buffer_event_length() logic.

Patch Information

The fix adds RB_FORCE_8BYTE_ALIGNMENT as a condition to subtract sizeof(event->array[0]) in ring_buffer_event_length(), restoring symmetry with rb_calculate_event_length(). Patches are available upstream: Kernel Git Commit 3a63a118, 14057268, 24c3fa71, 7c9f0ccf, c37e0a4b, cfada73f, dbcb8635, and ec5e96ae. Distribution maintainers will ship the fix as part of routine stable kernel updates.

Workarounds

No functional workaround exists. Trace consumers can compensate by validating event payload lengths against known event schemas until the patched kernel is deployed.
On non-affected architectures where RB_FORCE_8BYTE_ALIGNMENT is false, no action is required beyond routine kernel maintenance.
Avoid relying on ring_buffer_event_length() output for security-critical decisioning on unpatched systems.