Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-99158— ring-buffer: Fix false warning in ring_buffer_map_get_reader()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： 环形缓冲区（ring-buffer）：修复 中的误报警告。 当 mmap 读取器追上仍在提交事件的写入器时，可能会触发警告。此时 会返回 NULL，但 却将该结果视为错误。 初始的 检查可以过滤掉空缓冲区，但并不能保证下一个读取器页面已包含已提交的数据。写入器不会获取 ，因此可能在发布新页面上的已提交长度之前，就提前推进 。 可能切换至该页面，追上写入器并返回 NULL。 修复方案：通过现有的“无数据”退出路径处理 NULL 返回值，不再发出警告。同时移除调用方中 的检

Possible ATT&CK Techniques 1 AI

T1069 · Permission Groups Discovery

Affected Version Matrix 8

VendorProduct Version RangeStatus
Linux Linux 117c39200d9d760cbd5944bb89efb7b9c51965aa< 029770f5badedc0f0ff85fc45e24785cbbee4a67 affected
117c39200d9d760cbd5944bb89efb7b9c51965aa< 68e6ab180cfb6dfa79652f41ed7899a6d4cf5438 affected
117c39200d9d760cbd5944bb89efb7b9c51965aa< 89bab1dba8a0167ef0d819e0f55b6bafa038e87f affected
6.10 affected
< 6.10 unaffected
6.18.59≤ 6.18.* unaffected
7.2.13≤ 7.2.* unaffected
7.3≤ * unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-99158

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ring-buffer: Fix false warning in ring_buffer_map_get_reader()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix false warning in ring_buffer_map_get_reader() The mmap reader can warn when it catches up with a writer that is still committing events. rb_get_reader_page() returns NULL in this case, but ring_buffer_map_get_reader() treats that result as an error. The initial rb_per_cpu_empty() check filters out an empty buffer, but it does not guarantee that the next reader page has committed data. Writers do not take reader_lock and can advance commit_page before publishing the committed length on the new page. rb_get_reader_page() can swap to that page, catch up with the writer and return NULL. Handle NULL through the existing no-data exit without warning. Remove the caller's reader_page == commit_page check as well, since the reader-page helper already handles that case. The existing metadata update and return path remain in place.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 117c39200d9d760cbd5944bb89efb7b9c51965aa ~ 029770f5badedc0f0ff85fc45e24785cbbee4a67 -
Linux Linux 6.10 -

II. Public POCs for CVE-2026-99158

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-99158

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-99158 (2)

Same Patch Batch · Linux · 2026-10-28 · 117 CVEs total

CVE-2026-99143 tracing: Keep the predicate limit separate from program capacity
CVE-2026-99129 selinux: fix BPF token permission checks
CVE-2026-99130 io_uring/cancel: don't spin on local work the task can't run
CVE-2026-99131 xfs: fix capability check in xfs
CVE-2026-99133 net/iucv: fix the recvmsg window update
CVE-2026-99132 xfs: don't hold buffer locks across sync transaction commit in xfs_sync_sb_buf
CVE-2026-99134 mac802154: fix data race and NULL deref on local->assoc_dev
CVE-2026-99135 dm-integrity: fix infinite loop on discard with large tag size
CVE-2026-99137 cifs: don't update i_size in cifs_do_truncate without a cached handle
CVE-2026-99136 dm-crypt: fix a tiny race condition in crypt_dec_pending
CVE-2026-99138 tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO)
CVE-2026-99140 tracing: Fix hist trigger timestamps for buffered events
CVE-2026-99139 tcp: fix use-after-free in do_tcp_getsockopt(TCP_CONGESTION)
CVE-2026-99141 tracing: Fix crash in print_graph_function_event()
CVE-2026-99142 tracing: Check operator stack capacity before pushing
CVE-2026-99154 scsi: libiscsi: Reject a negative task index from parse_pdu_itt
CVE-2026-99151 drm/amd/display: Fix NULL sink dereference in USB4 bandwidth functions
CVE-2026-99153 scsi: libiscsi: Validate the ITT reflected in a Reject PDU
CVE-2026-99152 scsi: libiscsi: Validate the task named by a management response
CVE-2026-99150 drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr

Showing top 20 of 117 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux