CVE-2026-89747: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89747 Overview

CVE-2026-89747 is a use-after-free vulnerability in the Linux kernel's tracing subsystem. The flaw affects trace_pipe readers when the ring buffer sub-buffer order changes concurrently. Writing to buffer_subbuf_size_kb triggers ring_buffer_subbuf_order_set(), which frees every sub-buffer including the reader page. A concurrent reader holding pointers into those pages then dereferences freed memory through ring_buffer_event_length() and ring_buffer_event_data(). Kernel Address Sanitizer (KASAN) confirmed the use-after-free in ring_buffer_peek(). The issue was fixed by taking trace_access_lock(RING_BUFFER_ALL_CPUS) around the order change, aligning with the lock scope already used by trace_pipe readers.

Critical Impact
Local attackers with tracing access can trigger a kernel use-after-free, enabling privilege escalation or denial of service on affected Linux systems.

Affected Products

Linux kernel (mainline versions containing ring buffer sub-buffer order support)
Linux stable kernel branches referenced in the upstream fix commits
Distributions shipping vulnerable kernel builds prior to the patch

Discovery Timeline

2026-09-11 - CVE-2026-89747 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89747

Vulnerability Analysis

The vulnerability resides in the Linux kernel tracing infrastructure, specifically in the ring buffer implementation used by trace_pipe. The tracing subsystem allows userspace to configure the size of ring buffer sub-buffers by writing to buffer_subbuf_size_kb. This write path invokes ring_buffer_subbuf_order_set() in kernel/trace/ring_buffer.c, which reallocates all sub-buffers, including the reader page consumed by active tracers.

Concurrent readers of trace_pipe use ring_buffer_peek() to look up the next event. The function acquires cpu_buffer->reader_lock to identify the event but returns the event pointer after releasing the lock. The caller, peek_next_entry(), then invokes ring_buffer_event_length() and ring_buffer_event_data() on that pointer outside any lock protecting the underlying page.

When the sub-buffer order changes during that window, the memory backing the peeked event is freed via free_buffer_page(). The reader continues to dereference the stale pointer, producing the KASAN-reported use-after-free.

Root Cause

The root cause is missing synchronization between ring buffer reconfiguration and concurrent readers. ring_buffer_subbuf_order_set() frees and replaces sub-buffer pages without holding trace_access_lock(RING_BUFFER_ALL_CPUS), which is the lock trace_pipe readers already hold across their entire peek-and-print loop. This mismatch creates a race window classified as Use After Free.

Attack Vector

Exploitation requires local access with permissions to write to tracing control files, typically located under /sys/kernel/tracing/. An attacker triggers the race by opening trace_pipe in one thread while another thread repeatedly writes new values to buffer_subbuf_size_kb. Successful races corrupt kernel memory and can be leveraged for privilege escalation. The KASAN trace confirms the fault path through ring_buffer_peek+0x3e0/0x430, reached from buffer_subbuf_size_write in kernel/trace/trace.c.

No public proof-of-concept or in-the-wild exploitation has been reported. Refer to the upstream kernel commit for the technical fix details.

Detection Methods for CVE-2026-89747

Indicators of Compromise

KASAN reports referencing use-after-free in ring_buffer_peek in kernel logs (dmesg, journalctl -k)
Unexpected kernel oops or panic traces originating from kernel/trace/ring_buffer.c or kernel/trace/trace.c
Unusual processes writing to buffer_subbuf_size_kb while trace_pipe is open by an unrelated process

Detection Strategies

Audit access to tracing control files under /sys/kernel/tracing/ and /sys/kernel/debug/tracing/ using auditd rules
Monitor for non-root or unexpected UIDs performing writes to buffer_subbuf_size_kb
Enable KASAN in test and staging kernels to surface the exact fault before production deployment

Monitoring Recommendations

Forward kernel logs to a centralized logging platform and alert on KASAN or ring buffer stack traces
Track kernel version inventory across the fleet to identify hosts running unpatched builds
Correlate tracing subsystem access with process lineage to detect anomalous privilege use

How to Mitigate CVE-2026-89747

Immediate Actions Required

Apply the upstream kernel patch that wraps ring_buffer_subbuf_order_set() with trace_access_lock(RING_BUFFER_ALL_CPUS)
Update to a distribution kernel that includes the fix commits referenced by the kernel.org stable tree
Restrict write access to tracing configuration files to root and trusted administrative accounts only

Patch Information

The fix takes trace_access_lock(RING_BUFFER_ALL_CPUS) around the sub-buffer order change so the swap can no longer race with a reader dereferencing a peeked event. Patches are available in the following upstream commits: Kernel Commit 05ebe1e1, Kernel Commit 372f8534, Kernel Commit 7a49d19f, and Kernel Commit ddbe921e.

Workarounds

Remove world-writable or group-writable permissions on /sys/kernel/tracing/buffer_subbuf_size_kb where feasible
Restrict CAP_SYS_ADMIN and tracing group membership to a minimal set of accounts
Disable tracefs mounts on production systems that do not require kernel tracing

bash

# Restrict tracing subsystem access to root
mount -o remount,mode=0700 /sys/kernel/tracing
chown -R root:root /sys/kernel/tracing
chmod 600 /sys/kernel/tracing/buffer_subbuf_size_kb

# Verify running kernel includes the fix
uname -r
dmesg | grep -i "ring_buffer"