CVE-2026-89499— ring-buffer: Stop remote reader update when page swap fails
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Linux 内核中，以下漏洞已得到修复： 环形缓冲区：在页面交换失败时停止远程读取器更新 在小型缓冲区上发生事件风暴时，当写入器在远程读取器同步之前移动了头部指针， 回调可能返回 。目前， 函数在遇到该失败时会发出警告，但仍使用未改变的读取器 ID 继续执行，并像交换成功一样重新排列本地页面列表。 现在，将该回调的失败处理为可恢复错误：使用 报告该错误，并返回 。调用方已经能够处理返回 读取器页面的情况，将其视为一次失败的尝试。这样可以避免在高竞争环境下，将同一页面同时作为前一个读取器和新读取器进行拼接时，导致
Affected Version Matrix 6
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 2e67fabd8b77c4f482df9b211bca1b495c6c2c24< a14a97048e48471e283d76879b83d2ae323e0722 |
affected |
2e67fabd8b77c4f482df9b211bca1b495c6c2c24< 5eab74874d11160725c42ab676ba97a797a362eb |
affected | ||
7.1 |
affected | ||
< 7.1 |
unaffected | ||
7.2.4≤ 7.2.* |
unaffected | ||
7.3-rc1≤ * |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-89499
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ring-buffer: Stop remote reader update when page swap fails
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
ring-buffer: Stop remote reader update when page swap fails
The remote swap_reader_page callback can return -EBUSY when the writer
moves the head before the remote catches it, particularly during an event
storm on a small buffer. __rb_get_reader_page_from_remote() currently
warns about that failure but continues with the unchanged reader ID and
rearranges the local page list as though the swap succeeded.
Handle the callback failure as a recoverable error. Report it with
pr_warn_ratelimited() and return NULL. Callers already handle a NULL reader
page as a failed attempt. This avoids splicing the same page as both the
previous and new reader without flooding the log under contention.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-89499
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-89499
请登录查看更多情报信息。
Other References for CVE-2026-89499 (2)
Same Patch Batch · Linux · 2026-09-11 · 431 CVEs total
| CVE-2026-89491 | ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin() | |
| CVE-2026-89477 | sctp: fix NULL deref on untransmitted RECONF completion | |
| CVE-2026-89478 | sctp: drop a chunk if its transport was removed | |
| CVE-2026-89479 | sctp: stop processing a packet once its association is deleted | |
| CVE-2026-89480 | nvme-tcp: reject a read that transferred too few bytes | |
| CVE-2026-89482 | nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone | |
| CVE-2026-89481 | nvme-tcp: fix host memory disclosure on R2T for a read command | |
| CVE-2026-89483 | nvme: zero the discard fallback page | |
| CVE-2026-89484 | lockd: fix NULL dereference on lockowner allocation failure | |
| CVE-2026-89485 | lockd: pin next file across nlm_inspect_file lock-drop | |
| CVE-2026-89486 | ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user() | |
| CVE-2026-89487 | openvswitch: only skb_tx_error() a packet we are about to drop | |
| CVE-2026-89488 | openvswitch: Fix CT limit teardown use-after-free | |
| CVE-2026-89489 | openrisc: fix arbitrary kernel memory access via or1k_atomic syscall | |
| CVE-2026-89501 | ring-buffer: Hold cpu_buffer::lock when resizing a subbuf | |
| CVE-2026-89497 | orangefs: skip leading spaces before parsing client debug masks | |
| CVE-2026-89498 | orangefs: fix double-free of trailer_buf on readdir copy failure | |
| CVE-2026-89500 | ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page | |
| CVE-2026-89496 | ocfs2: always run deallocs on copy-on-write completion | |
| CVE-2026-89502 | ring-buffer: Free cpu_buffer::free_page with subbuf_order |
Showing top 20 of 431 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-89773
drm/amd/display: Skip Update HDCP Config In Transition State -
CVE-2026-89772
btrfs: write-protect folios during data writeback -
CVE-2026-89771
ring-buffer: Fix subbuf resize race with ring buffer readers -
CVE-2026-89770
iomap: don't free integrity payload that doesn't exist -
CVE-2026-89769
clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_sta
Same vendor: Linux
-
CVE-2026-89773
drm/amd/display: Skip Update HDCP Config In Transition State -
CVE-2026-89772
btrfs: write-protect folios during data writeback -
CVE-2026-89771
ring-buffer: Fix subbuf resize race with ring buffer readers -
CVE-2026-89770
iomap: don't free integrity payload that doesn't exist -
CVE-2026-89769
clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_sta
V. Comments for CVE-2026-89499
No comments yet