{"id":"CVE-2026-98032","revision":"c1a15b3fc82e4ba8a7b9e846e599acc1","records":[{"revision":"c1a15b3fc82e4ba8a7b9e846e599acc1","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-98032","aliases":[],"title":"tracing: Fix subbuf resize races with trace_pipe_raw readers","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix subbuf resize races with trace_pipe_raw readers\n\nConcurrent subbuffer resizes may crash trace_pipe_raw readers or leak\nuninitialized memory to userspace due to stale size values.\n\nModify ring_buffer_alloc_read_page() to handle the resizing of an\nexisting buffer_data_read_page if necessary and add a new\nring_buffer_read_page_size(). This new function enables ring-buffer\nbuffer_data_read_page users to not call the racy\nring_buffer_subbuf_size_get(). This makes the spare_size member of\nftrace_buffer_info redundant.\n\nFinally, handle buffer_data_read_page/reader_page order discrepancy in\nring_buffer_read_page(). On a mismatch simply copy manually the data to\nthe buffer_data_read_page.","state":0,"publishedAt":"2026-09-25T10:23:48.169+00:00","modifiedAt":"2026-10-21T12:54:06.279+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"include/linux/ring_buffer.h\",\n                        \"kernel/trace/ring_buffer.c\",\n                        \"kernel/trace/ring_buffer_benchmark.c\",\n                        \"kernel/trace/trace.c\",\n                        \"kernel/trace/trace.h\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"bce761d757452ba5eb77e11fecc37a04b67494e7\",\n                            \"lessThan\": \"574efd988d116bd56ac688ab2d64e06ba0da982a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"bce761d757452ba5eb77e11fecc37a04b67494e7\",\n                            \"lessThan\": \"3f30b2cd4eba45c05f822f03f1b0f4077d6d4dc3\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"bce761d757452ba5eb77e11fecc37a04b67494e7\",\n                            \"lessThan\": \"75b37b8369778b69ce9738d1c97685a1615cb252\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"bce761d757452ba5eb77e11fecc37a04b67494e7\",\n                            \"lessThan\": \"dae8dda341d2d9034a90d59e8a7d502e1263813f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"include/linux/ring_buffer.h\",\n                        \"kernel/trace/ring_buffer.c\",\n                        \"kernel/trace/ring_buffer_benchmark.c\",\n                        \"kernel/trace/trace.c\",\n                        \"kernel/trace/trace.h\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.8\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.8\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.114\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.57\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.7\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/574efd988d116bd56ac688ab2d64e06ba0da982a","https://git.kernel.org/stable/c/3f30b2cd4eba45c05f822f03f1b0f4077d6d4dc3","https://git.kernel.org/stable/c/75b37b8369778b69ce9738d1c97685a1615cb252","https://git.kernel.org/stable/c/dae8dda341d2d9034a90d59e8a7d502e1263813f"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98032","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-98032","identifiers":["CVE-2026-98032"]},"retained":false,"historicalAffected":[]}],"coverage":[]}