CVE-2026-97617

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97617", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-24T16:01:01.159Z", "datePublished": "2026-09-25T10:22:24.436Z", "dateUpdated": "2026-10-19T09:10:20.808Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:10:20.808Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nring-buffer: Check resize_disabled before publishing the new subbuf order\n\nring_buffer_subbuf_order_set() stores the new order and only then walks\nthe CPUs, returning -EBUSY if any of them has resizing disabled. A user\nmapped buffer has resizing disabled, and __rb_map_vma() reads\nbuffer->subbuf_order without buffer->mutex, so an mmap of an already\nmapped CPU racing the failing order change sizes the mapping with the\nnew order and inserts pages past the sub-buffer into the VMA.\n\nCheck the CPUs before storing the new order."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/trace/ring_buffer.c"], "versions": [{"version": "117c39200d9d760cbd5944bb89efb7b9c51965aa", "lessThan": "f2099644e1b2a2c0805c5240d63ab0522d9d0174", "status": "affected", "versionType": "git"}, {"version": "117c39200d9d760cbd5944bb89efb7b9c51965aa", "lessThan": "9fd4ea952e6ac12a63c3fe89f08ad02771aa2c06", "status": "affected", "versionType": "git"}, {"version": "117c39200d9d760cbd5944bb89efb7b9c51965aa", "lessThan": "32bf47db9237c5b8b6f6aaa5356bb4c79d241f76", "status": "affected", "versionType": "git"}, {"version": "117c39200d9d760cbd5944bb89efb7b9c51965aa", "lessThan": "d860c67c051685abb0460b593b193f0f45f4fa92", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/trace/ring_buffer.c"], "versions": [{"version": "6.10", "status": "affected"}, {"version": "0", "lessThan": "6.10", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/f2099644e1b2a2c0805c5240d63ab0522d9d0174"}, {"url": "https://git.kernel.org/stable/c/9fd4ea952e6ac12a63c3fe89f08ad02771aa2c06"}, {"url": "https://git.kernel.org/stable/c/32bf47db9237c5b8b6f6aaa5356bb4c79d241f76"}, {"url": "https://git.kernel.org/stable/c/d860c67c051685abb0460b593b193f0f45f4fa92"}], "title": "ring-buffer: Check resize_disabled before publishing the new subbuf order", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/trace/ring_buffer.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "f2099644e1b2a2c0805c5240d63ab0522d9d0174", "status": "affected", "version": "117c39200d9d760cbd5944bb89efb7b9c51965aa", "versionType": "git"}, {"lessThan": "9fd4ea952e6ac12a63c3fe89f08ad02771aa2c06", "status": "affected", "version": "117c39200d9d760cbd5944bb89efb7b9c51965aa", "versionType": "git"}, {"lessThan": "32bf47db9237c5b8b6f6aaa5356bb4c79d241f76", "status": "affected", "version": "117c39200d9d760cbd5944bb89efb7b9c51965aa", "versionType": "git"}, {"lessThan": "d860c67c051685abb0460b593b193f0f45f4fa92", "status": "affected", "version": "117c39200d9d760cbd5944bb89efb7b9c51965aa", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/trace/ring_buffer.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.10"}, {"lessThan": "6.10", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nring-buffer: Check resize_disabled before publishing the new subbuf order\n\nring_buffer_subbuf_order_set() stores the new order and only then walks\nthe CPUs, returning -EBUSY if any of them has resizing disabled. A user\nmapped buffer has resizing disabled, and __rb_map_vma() reads\nbuffer->subbuf_order without buffer->mutex, so an mmap of an already\nmapped CPU racing the failing order change sizes the mapping with the\nnew order and inserts pages past the sub-buffer into the VMA.\n\nCheck the CPUs before storing the new order."}], "id": "CVE-2026-97617", "lastModified": "2026-10-19T10:17:32.230", "metrics": {}, "published": "2026-09-25T11:17:15.893", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/32bf47db9237c5b8b6f6aaa5356bb4c79d241f76"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9fd4ea952e6ac12a63c3fe89f08ad02771aa2c06"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d860c67c051685abb0460b593b193f0f45f4fa92"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f2099644e1b2a2c0805c5240d63ab0522d9d0174"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: ring-buffer: Check resize_disabled before publishing the new subbuf order", "id": "2541278", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541278"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nring-buffer: Check resize_disabled before publishing the new subbuf order\nring_buffer_subbuf_order_set() stores the new order and only then walks\nthe CPUs, returning -EBUSY if any of them has resizing disabled. A user\nmapped buffer has resizing disabled, and __rb_map_vma() reads\nbuffer->subbuf_order without buffer->mutex, so an mmap of an already\nmapped CPU racing the failing order change sizes the mapping with the\nnew order and inserts pages past the sub-buffer into the VMA.\nCheck the CPUs before storing the new order.", "A flaw was found in the Linux kernel's ring buffer subsystem. A race condition occurs when updating the buffer configuration concurrently with memory mapping operations. Because the kernel applies the new buffer order before verifying that resizing is permitted across all processors, the system can map out-of-bounds memory pages. A local user could exploit this vulnerability to cause memory corruption or a denial of service (DoS) through a system crash."], "name": "CVE-2026-97617", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-97617\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-97617\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97617.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[117c39200d9d760cbd5944bb89efb7b9c51965aa,f2099644e1b2a2c0805c5240d63ab0522d9d0174)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[117c39200d9d760cbd5944bb89efb7b9c51965aa,9fd4ea952e6ac12a63c3fe89f08ad02771aa2c06)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[117c39200d9d760cbd5944bb89efb7b9c51965aa,32bf47db9237c5b8b6f6aaa5356bb4c79d241f76)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[117c39200d9d760cbd5944bb89efb7b9c51965aa,d860c67c051685abb0460b593b193f0f45f4fa92)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.10"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.10)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.111,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.7,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T18:45:17.608006+00:00", "updated": "2026-10-01T11:30:05.844471+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}