Answer in brief
CVE-2026-89747 records a High severity (CVSS 7.8) vulnerability in tracing: Fix use-after-free in trace_pipe read on sub-buffer order change. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=f9b94daa542a8d2532f0930f01cd9aec2d19621b <05ebe1e1d7d38c2612bacfefe043a33572ae34cb || >=f9b94daa542a8d2532f0930f01cd9aec2d19621b <ddbe921ed16a0ad2d9e09574c3f3aabec7528325 || >=f9b94daa542a8d2532f0930f01cd9aec2d19621b <7a49d19ff9baaf61217e5ec14199c18bc2d93ee4 || >=f9b94daa542a8d2532f0930f01cd9aec2d19621b <372f8534244d632ad5118e8a87a11291b01712d3 | 05ebe1e1d7d38c2612bacfefe043a33572ae34cb, ddbe921ed16a0ad2d9e09574c3f3aabec7528325, 7a49d19ff9baaf61217e5ec14199c18bc2d93ee4, 372f8534244d632ad5118e8a87a11291b01712d3 |
| Linux/Linuxgeneric | 6.8 | Not reported |
Published upstream
Sep 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 11, 2026
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free in trace_pipe read on sub-buffer order change Writing to buffer_subbuf_size_kb calls ring_buffer_subbuf_order_set(), which frees every sub-buffer of the ring buffer, including the reader page, and replaces them with newly allocated ones. Readers of trace_pipe hold pointers into those pages. ring_buffer_peek() looks up an event under cpu_buffer->reader_lock but returns the event pointer after dropping the lock, and peek_next_entry() then calls ring_buffer_event_length() and ring_buffer_event_data() on it. If the sub-buffer order is changed in that window, the reader dereferences freed memory: BUG: KASAN: use-after-free in ring_buffer_peek+0x3e0/0x430 Read of size 1 at addr ffff88802a4cf010 by task syz-executor989/6002 Freed by: free_buffer_page kernel/trace/ring_buffer.c:398 [inline] ring_buffer_subbuf_order_set+0x1325/0x18e0 kernel/trace/ring_buffer.c:7444 buffer_subbuf_size_write+0x182/0x280 kernel/trace/trace.c:8221 Take trace_access_lock(RING_BUFFER_ALL_CPUS) around the order change. This is the lock trace_pipe readers already hold across their entire peek-and-print loop, so the swap can no longer race with a reader that is dereferencing a peeked event.
Quoted source text, attributed separately from HOL analysis.