CVE-2026-74601

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74601", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.919Z", "datePublished": "2026-08-22T15:31:50.092Z", "dateUpdated": "2026-10-16T19:06:00.447Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-25T05:40:26.170Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nring-buffer: Use current_context for safe per-CPU buffer swap\n\nThe ring_buffer_swap_cpu() function currently checks the per-CPU\ncommitting counter to determine if a buffer is actively being written to\nbefore performing the swap. However, there exists a race window where\nthis check can be bypassed:\n\n ring_buffer_lock_reserve\n cpu_buffer = buffer->buffers[cpu]; // cpu_buffer_a\n rb_reserve_next_event\n rb_start_commit // inc committing\n if (unlikely(READ_ONCE(cpu_buffer->buffer) != buffer)) {...}\n __rb_reserve_next\n rb_move_tail\n rb_end_commit(cpu_buffer); // dec committing => 0\n /* interrupt hits here, successfully swaps! */\n local_inc(&cpu_buffer->committing);\n\n ring_buffer_unlock_commit\n cpu_buffer = buffer->buffers[cpu]; // cpu_buffer_b\n rb_commit\n rb_end_commit\n RB_WARN_ON(cpu_buffer, !local_read(&cpu_buffer->committing))\n // triggers warning\n\nThe committing counter can temporarily drop to 0 during a single write\noperation (within rb_move_tail), creating a window where swap can\nsucceed even though the write is still in progress. This leads to\ninconsistent buffer state and triggers the RB_WARN_ON in rb_commit().\n\nReplace the committing counter check with current_context checks, which\nare set at the entry of ring_buffer_lock_reserve() and remain valid\nthroughout the entire write operation, providing a reliable indicator of\nbuffer busy state during swap."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation requires local tracefs writes to snapshot or latency tracers; ring_buffer_swap_cpu() is only reached from update_max_tr_single() via tracing_snapshot_write or irqsoff/preemptoff tracers, with no network, adjacent, or physical entry path.\nAC:L - The attacker controls both sides of the race by enabling irqsoff/preemptoff tracing or hammering per_cpu/*/snapshot while generating trace events that cross page boundaries, reliably hitting the rb_move_tail window where committing briefly drops to zero.\nPR:L - tracing_check_open_get_tr() enforces only LOCKDOWN_TRACEFS and DAC with no capable() check; tracefs gid= mounts, Android/Perfetto/ChromeOS tracing groups, and container user+mount namespaces routinely grant unprivileged local write access to snapshot and current_tracer.\nUI:N - The attacker enables tracers and triggers buffer swaps through their own tracefs writes and syscalls; no victim cooperation, unrelated user action, or third-party interaction is required.\nS:U - Impact is corrupted kernel ring-buffer metadata and WARN_ON within the same kernel security domain; this is not a VM escape, IOMMU bypass, or cross-authority sandbox breakout.\nC:H - Swapping per-CPU buffers mid-write leaves ring_buffer_per_cpu page, tail, and commit state inconsistent across buffers; subsequent trace reads or commits can access wrong backing pages, constituting kernel-memory corruption with arbitrary-read potential.\nI:H - Mid-reservation buffer swap causes unlock_commit on the wrong cpu_buffer with mismatched tail/commit page pointers, corrupting ring-buffer page lists and write metadata in ways exploitable for heap corruption and control-flow manipulation.\nA:H - rb_end_commit() hits RB_WARN_ON triggering WARN_ON and disabling recording; corrupted ring-buffer page state from this swap race has caused kernel oops/panic in related ring_buffer_swap_cpu bugs, and panic_on_warn makes the WARN fatal."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/trace/ring_buffer.c"], "versions": [{"version": "4239c38fe0b3847e1e6d962c74b41b08ba0e2990", "lessThan": "26662bc8fced1d668fa1aa146eda085bfc67bd0b", "status": "affected", "versionType": "git"}, {"version": "4239c38fe0b3847e1e6d962c74b41b08ba0e2990", "lessThan": "6b524e6b234e45c7f5f90d13b042c6f57f80105c", "status": "affected", "versionType": "git"}, {"version": "4239c38fe0b3847e1e6d962c74b41b08ba0e2990", "lessThan": "597f279b7b4a06412e3d965e98cc36e181cdbede", "status": "affected", "versionType": "git"}, {"version": "4239c38fe0b3847e1e6d962c74b41b08ba0e2990", "lessThan": "22709117d9ae95e52673685f98caac7c356a8227", "status": "affected", "versionType": "git"}, {"version": "4239c38fe0b3847e1e6d962c74b41b08ba0e2990", "lessThan": "ad7e10c7ea89af45ac1bf1814855d45da472703d", "status": "affected", "versionType": "git"}, {"version": "4239c38fe0b3847e1e6d962c74b41b08ba0e2990", "lessThan": "5b926fb04cb9ef3156dcf88c69a59d3d1a1c4f9f", "status": "affected", "versionType": "git"}, {"version": "4239c38fe0b3847e1e6d962c74b41b08ba0e2990", "lessThan": "5e6e2a18c20e88167d414f666032792e8bf19b80", "status": "affected", "versionType": "git"}, {"version": "4239c38fe0b3847e1e6d962c74b41b08ba0e2990", "lessThan": "f27bdc43077e4fcb5557dfc315ee8d91e741f483", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/trace/ring_buffer.c"], "versions": [{"version": "4.5", "status": "affected"}, {"version": "0", "lessThan": "4.5", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.266", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.217", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.184", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.153", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.105", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.45", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.9", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.5", "versionEndExcluding": "5.10.266"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.5", "versionEndExcluding": "5.15.217"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.5", "versionEndExcluding": "6.1.184"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.5", "versionEndExcluding": "6.6.153"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.5", "versionEndExcluding": "6.12.105"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.5", "versionEndExcluding": "6.18.45"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.5", "versionEndExcluding": "7.1.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.5", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/26662bc8fced1d668fa1aa146eda085bfc67bd0b"}, {"url": "https://git.kernel.org/stable/c/6b524e6b234e45c7f5f90d13b042c6f57f80105c"}, {"url": "https://git.kernel.org/stable/c/597f279b7b4a06412e3d965e98cc36e181cdbede"}, {"url": "https://git.kernel.org/stable/c/22709117d9ae95e52673685f98caac7c356a8227"}, {"url": "https://git.kernel.org/stable/c/ad7e10c7ea89af45ac1bf1814855d45da472703d"}, {"url": "https://git.kernel.org/stable/c/5b926fb04cb9ef3156dcf88c69a59d3d1a1c4f9f"}, {"url": "https://git.kernel.org/stable/c/5e6e2a18c20e88167d414f666032792e8bf19b80"}, {"url": "https://git.kernel.org/stable/c/f27bdc43077e4fcb5557dfc315ee8d91e741f483"}], "title": "ring-buffer: Use current_context for safe per-CPU buffer swap", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74601", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T19:01:56.298970Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:06:00.447Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74601", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T19:01:56.298970Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:01:56.871Z"}}], "cna": {"title": "ring-buffer: Use current_context for safe per-CPU buffer swap", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation requires local tracefs writes to snapshot or latency tracers; ring_buffer_swap_cpu() is only reached from update_max_tr_single() via tracing_snapshot_write or irqsoff/preemptoff tracers, with no network, adjacent, or physical entry path.\nAC:L - The attacker controls both sides of the race by enabling irqsoff/preemptoff tracing or hammering per_cpu/*/snapshot while generating trace events that cross page boundaries, reliably hitting the rb_move_tail window where committing briefly drops to zero.\nPR:L - tracing_check_open_get_tr() enforces only LOCKDOWN_TRACEFS and DAC with no capable() check; tracefs gid= mounts, Android/Perfetto/ChromeOS tracing groups, and container user+mount namespaces routinely grant unprivileged local write access to snapshot and current_tracer.\nUI:N - The attacker enables tracers and triggers buffer swaps through their own tracefs writes and syscalls; no victim cooperation, unrelated user action, or third-party interaction is required.\nS:U - Impact is corrupted kernel ring-buffer metadata and WARN_ON within the same kernel security domain; this is not a VM escape, IOMMU bypass, or cross-authority sandbox breakout.\nC:H - Swapping per-CPU buffers mid-write leaves ring_buffer_per_cpu page, tail, and commit state inconsistent across buffers; subsequent trace reads or commits can access wrong backing pages, constituting kernel-memory corruption with arbitrary-read potential.\nI:H - Mid-reservation buffer swap causes unlock_commit on the wrong cpu_buffer with mismatched tail/commit page pointers, corrupting ring-buffer page lists and write metadata in ways exploitable for heap corruption and control-flow manipulation.\nA:H - rb_end_commit() hits RB_WARN_ON triggering WARN_ON and disabling recording; corrupted ring-buffer page state from this swap race has caused kernel oops/panic in related ring_buffer_swap_cpu bugs, and panic_on_warn makes the WARN fatal."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4239c38fe0b3847e1e6d962c74b41b08ba0e2990", "lessThan": "26662bc8fced1d668fa1aa146eda085bfc67bd0b", "versionType": "git"}, {"status": "affected", "version": "4239c38fe0b3847e1e6d962c74b41b08ba0e2990", "lessThan": "6b524e6b234e45c7f5f90d13b042c6f57f80105c", "versionType": "git"}, {"status": "affected", "version": "4239c38fe0b3847e1e6d962c74b41b08ba0e2990", "lessThan": "597f279b7b4a06412e3d965e98cc36e181cdbede", "versionType": "git"}, {"status": "affected", "version": "4239c38fe0b3847e1e6d962c74b41b08ba0e2990", "lessThan": "22709117d9ae95e52673685f98caac7c356a8227", "versionType": "git"}, {"status": "affected", "version": "4239c38fe0b3847e1e6d962c74b41b08ba0e2990", "lessThan": "ad7e10c7ea89af45ac1bf1814855d45da472703d", "versionType": "git"}, {"status": "affected", "version": "4239c38fe0b3847e1e6d962c74b41b08ba0e2990", "lessThan": "5b926fb04cb9ef3156dcf88c69a59d3d1a1c4f9f", "versionType": "git"}, {"status": "affected", "version": "4239c38fe0b3847e1e6d962c74b41b08ba0e2990", "lessThan": "5e6e2a18c20e88167d414f666032792e8bf19b80", "versionType": "git"}, {"status": "affected", "version": "4239c38fe0b3847e1e6d962c74b41b08ba0e2990", "lessThan": "f27bdc43077e4fcb5557dfc315ee8d91e741f483", "versionType": "git"}], "programFiles": ["kernel/trace/ring_buffer.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.5"}, {"status": "unaffected", "version": "0", "lessThan": "4.5", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.266", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.217", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.184", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.153", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.105", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.45", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.9", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["kernel/trace/ring_buffer.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/26662bc8fced1d668fa1aa146eda085bfc67bd0b"}, {"url": "https://git.kernel.org/stable/c/6b524e6b234e45c7f5f90d13b042c6f57f80105c"}, {"url": "https://git.kernel.org/stable/c/597f279b7b4a06412e3d965e98cc36e181cdbede"}, {"url": "https://git.kernel.org/stable/c/22709117d9ae95e52673685f98caac7c356a8227"}, {"url": "https://git.kernel.org/stable/c/ad7e10c7ea89af45ac1bf1814855d45da472703d"}, {"url": "https://git.kernel.org/stable/c/5b926fb04cb9ef3156dcf88c69a59d3d1a1c4f9f"}, {"url": "https://git.kernel.org/stable/c/5e6e2a18c20e88167d414f666032792e8bf19b80"}, {"url": "https://git.kernel.org/stable/c/f27bdc43077e4fcb5557dfc315ee8d91e741f483"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nring-buffer: Use current_context for safe per-CPU buffer swap\n\nThe ring_buffer_swap_cpu() function currently checks the per-CPU\ncommitting counter to determine if a buffer is actively being written to\nbefore performing the swap. However, there exists a race window where\nthis check can be bypassed:\n\n ring_buffer_lock_reserve\n cpu_buffer = buffer->buffers[cpu]; // cpu_buffer_a\n rb_reserve_next_event\n rb_start_commit // inc committing\n if (unlikely(READ_ONCE(cpu_buffer->buffer) != buffer)) {...}\n __rb_reserve_next\n rb_move_tail\n rb_end_commit(cpu_buffer); // dec committing => 0\n /* interrupt hits here, successfully swaps! */\n local_inc(&cpu_buffer->committing);\n\n ring_buffer_unlock_commit\n cpu_buffer = buffer->buffers[cpu]; // cpu_buffer_b\n rb_commit\n rb_end_commit\n RB_WARN_ON(cpu_buffer, !local_read(&cpu_buffer->committing))\n // triggers warning\n\nThe committing counter can temporarily drop to 0 during a single write\noperation (within rb_move_tail), creating a window where swap can\nsucceed even though the write is still in progress. This leads to\ninconsistent buffer state and triggers the RB_WARN_ON in rb_commit().\n\nReplace the committing counter check with current_context checks, which\nare set at the entry of ring_buffer_lock_reserve() and remain valid\nthroughout the entire write operation, providing a reliable indicator of\nbuffer busy state during swap."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.266", "versionStartIncluding": "4.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.217", "versionStartIncluding": "4.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.184", "versionStartIncluding": "4.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.153", "versionStartIncluding": "4.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.105", "versionStartIncluding": "4.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.45", "versionStartIncluding": "4.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.9", "versionStartIncluding": "4.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "4.5"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-25T05:40:26.170Z"}}}, "cveMetadata": {"cveId": "CVE-2026-74601", "state": "PUBLISHED", "dateUpdated": "2026-10-16T19:06:00.447Z", "dateReserved": "2026-08-15T05:44:03.919Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-22T15:31:50.092Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/trace/ring_buffer.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "26662bc8fced1d668fa1aa146eda085bfc67bd0b", "status": "affected", "version": "4239c38fe0b3847e1e6d962c74b41b08ba0e2990", "versionType": "git"}, {"lessThan": "6b524e6b234e45c7f5f90d13b042c6f57f80105c", "status": "affected", "version": "4239c38fe0b3847e1e6d962c74b41b08ba0e2990", "versionType": "git"}, {"lessThan": "597f279b7b4a06412e3d965e98cc36e181cdbede", "status": "affected", "version": "4239c38fe0b3847e1e6d962c74b41b08ba0e2990", "versionType": "git"}, {"lessThan": "22709117d9ae95e52673685f98caac7c356a8227", "status": "affected", "version": "4239c38fe0b3847e1e6d962c74b41b08ba0e2990", "versionType": "git"}, {"lessThan": "ad7e10c7ea89af45ac1bf1814855d45da472703d", "status": "affected", "version": "4239c38fe0b3847e1e6d962c74b41b08ba0e2990", "versionType": "git"}, {"lessThan": "5b926fb04cb9ef3156dcf88c69a59d3d1a1c4f9f", "status": "affected", "version": "4239c38fe0b3847e1e6d962c74b41b08ba0e2990", "versionType": "git"}, {"lessThan": "5e6e2a18c20e88167d414f666032792e8bf19b80", "status": "affected", "version": "4239c38fe0b3847e1e6d962c74b41b08ba0e2990", "versionType": "git"}, {"lessThan": "f27bdc43077e4fcb5557dfc315ee8d91e741f483", "status": "affected", "version": "4239c38fe0b3847e1e6d962c74b41b08ba0e2990", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/trace/ring_buffer.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.5"}, {"lessThan": "4.5", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.266", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.217", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.184", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.153", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.105", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.45", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nring-buffer: Use current_context for safe per-CPU buffer swap\n\nThe ring_buffer_swap_cpu() function currently checks the per-CPU\ncommitting counter to determine if a buffer is actively being written to\nbefore performing the swap. However, there exists a race window where\nthis check can be bypassed:\n\n ring_buffer_lock_reserve\n cpu_buffer = buffer->buffers[cpu]; // cpu_buffer_a\n rb_reserve_next_event\n rb_start_commit // inc committing\n if (unlikely(READ_ONCE(cpu_buffer->buffer) != buffer)) {...}\n __rb_reserve_next\n rb_move_tail\n rb_end_commit(cpu_buffer); // dec committing => 0\n /* interrupt hits here, successfully swaps! */\n local_inc(&cpu_buffer->committing);\n\n ring_buffer_unlock_commit\n cpu_buffer = buffer->buffers[cpu]; // cpu_buffer_b\n rb_commit\n rb_end_commit\n RB_WARN_ON(cpu_buffer, !local_read(&cpu_buffer->committing))\n // triggers warning\n\nThe committing counter can temporarily drop to 0 during a single write\noperation (within rb_move_tail), creating a window where swap can\nsucceed even though the write is still in progress. This leads to\ninconsistent buffer state and triggers the RB_WARN_ON in rb_commit().\n\nReplace the committing counter check with current_context checks, which\nare set at the entry of ring_buffer_lock_reserve() and remain valid\nthroughout the entire write operation, providing a reliable indicator of\nbuffer busy state during swap."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nring-buffer: Usar current_context para un intercambio seguro de b\u00fafer por CPU\n\nLa funci\u00f3n ring_buffer_swap_cpu() actualmente verifica el contador de 'committing' por CPU para determinar si se est\u00e1 escribiendo activamente en un b\u00fafer antes de realizar el intercambio. Sin embargo, existe una ventana de carrera donde esta verificaci\u00f3n puede ser eludida:\n\n ring_buffer_lock_reserve\n cpu_buffer = buffer -> buffers[cpu]; // cpu_buffer_a\n rb_reserve_next_event\n rb_start_commit // inc committing\n if (unlikely(READ_ONCE(cpu_buffer -> buffer) != buffer)) {...}\n __rb_reserve_next\n rb_move_tail\n rb_end_commit(cpu_buffer); // dec committing => 0\n /* \u00a1la interrupci\u00f3n ocurre aqu\u00ed, el intercambio se realiza con \u00e9xito! */\n local_inc(&cpu_buffer -> committing);\n\n ring_buffer_unlock_commit\n cpu_buffer = buffer -> buffers[cpu]; // cpu_buffer_b\n rb_commit\n rb_end_commit\n RB_WARN_ON(cpu_buffer, !local_read(&cpu_buffer -> committing))\n // activa la advertencia\n\nEl contador de 'committing' puede caer temporalmente a 0 durante una \u00fanica operaci\u00f3n de escritura (dentro de rb_move_tail), creando una ventana donde el intercambio puede tener \u00e9xito aunque la escritura a\u00fan est\u00e9 en progreso. Esto lleva a un estado de b\u00fafer inconsistente y activa el RB_WARN_ON en rb_commit().\n\nReemplace la verificaci\u00f3n del contador de 'committing' con verificaciones de current_context, las cuales se establecen a la entrada de ring_buffer_lock_reserve() y permanecen v\u00e1lidas durante toda la operaci\u00f3n de escritura, proporcionando un indicador fiable del estado de ocupado del b\u00fafer durante el intercambio."}], "id": "CVE-2026-74601", "lastModified": "2026-10-16T20:17:45.437", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-74601", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T19:01:56.298970Z", "version": "2.0.3"}}]}, "published": "2026-08-22T16:16:32.530", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/22709117d9ae95e52673685f98caac7c356a8227"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/26662bc8fced1d668fa1aa146eda085bfc67bd0b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/597f279b7b4a06412e3d965e98cc36e181cdbede"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5b926fb04cb9ef3156dcf88c69a59d3d1a1c4f9f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5e6e2a18c20e88167d414f666032792e8bf19b80"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6b524e6b234e45c7f5f90d13b042c6f57f80105c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ad7e10c7ea89af45ac1bf1814855d45da472703d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f27bdc43077e4fcb5557dfc315ee8d91e741f483"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: ring-buffer: Use current_context for safe per-CPU buffer swap", "id": "2521464", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521464"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-367", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nring-buffer: Use current_context for safe per-CPU buffer swap\nThe ring_buffer_swap_cpu() function currently checks the per-CPU\ncommitting counter to determine if a buffer is actively being written to\nbefore performing the swap. However, there exists a race window where\nthis check can be bypassed:\nring_buffer_lock_reserve\ncpu_buffer = buffer->buffers[cpu]; // cpu_buffer_a\nrb_reserve_next_event\nrb_start_commit // inc committing\nif (unlikely(READ_ONCE(cpu_buffer->buffer) != buffer)) {...}\n__rb_reserve_next\nrb_move_tail\nrb_end_commit(cpu_buffer); // dec committing => 0\n/* interrupt hits here, successfully swaps! */\nlocal_inc(&cpu_buffer->committing);\nring_buffer_unlock_commit\ncpu_buffer = buffer->buffers[cpu]; // cpu_buffer_b\nrb_commit\nrb_end_commit\nRB_WARN_ON(cpu_buffer, !local_read(&cpu_buffer->committing))\n// triggers warning\nThe committing counter can temporarily drop to 0 during a single write\noperation (within rb_move_tail), creating a window where swap can\nsucceed even though the write is still in progress. This leads to\ninconsistent buffer state and triggers the RB_WARN_ON in rb_commit().\nReplace the committing counter check with current_context checks, which\nare set at the entry of ring_buffer_lock_reserve() and remain valid\nthroughout the entire write operation, providing a reliable indicator of\nbuffer busy state during swap.", "A flaw was found in the Linux kernel's ring-buffer component. A race condition exists within the `ring_buffer_swap_cpu()` function, where a committing counter can temporarily drop to zero during a write operation. This allows a buffer swap to occur while a write is still in progress, resulting in an inconsistent buffer state. This inconsistency can lead to system instability and a denial of service."], "name": "CVE-2026-74601", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74601\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74601\nhttps://lore.kernel.org/linux-cve-announce/2026082215-CVE-2026-74601-7bba@gregkh/T"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4239c38fe0b3847e1e6d962c74b41b08ba0e2990,5b926fb04cb9ef3156dcf88c69a59d3d1a1c4f9f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4239c38fe0b3847e1e6d962c74b41b08ba0e2990,5e6e2a18c20e88167d414f666032792e8bf19b80)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[4239c38fe0b3847e1e6d962c74b41b08ba0e2990,f27bdc43077e4fcb5557dfc315ee8d91e741f483)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.5"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.5)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.45,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.9,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-22T17:30:02.932124+00:00", "updated": "2026-08-25T14:00:17.981106+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-367"]}