CVE-2026-99158

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99158", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.397Z", "datePublished": "2026-10-28T10:35:11.848Z", "dateUpdated": "2026-10-30T12:42:24.782Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:42:24.782Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nring-buffer: Fix false warning in ring_buffer_map_get_reader()\n\nThe mmap reader can warn when it catches up with a writer that is still\ncommitting events. rb_get_reader_page() returns NULL in this case, but\nring_buffer_map_get_reader() treats that result as an error.\n\nThe initial rb_per_cpu_empty() check filters out an empty buffer, but it\ndoes not guarantee that the next reader page has committed data. Writers\ndo not take reader_lock and can advance commit_page before publishing the\ncommitted length on the new page. rb_get_reader_page() can swap to that\npage, catch up with the writer and return NULL.\n\nHandle NULL through the existing no-data exit without warning. Remove the\ncaller's reader_page == commit_page check as well, since the reader-page\nhelper already handles that case. The existing metadata update and return\npath remain in place."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/trace/ring_buffer.c"], "versions": [{"version": "117c39200d9d760cbd5944bb89efb7b9c51965aa", "lessThan": "32751946f9b3e502e3d6e42d98b343473112f887", "status": "affected", "versionType": "git"}, {"version": "117c39200d9d760cbd5944bb89efb7b9c51965aa", "lessThan": "029770f5badedc0f0ff85fc45e24785cbbee4a67", "status": "affected", "versionType": "git"}, {"version": "117c39200d9d760cbd5944bb89efb7b9c51965aa", "lessThan": "68e6ab180cfb6dfa79652f41ed7899a6d4cf5438", "status": "affected", "versionType": "git"}, {"version": "117c39200d9d760cbd5944bb89efb7b9c51965aa", "lessThan": "89bab1dba8a0167ef0d819e0f55b6bafa038e87f", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/trace/ring_buffer.c"], "versions": [{"version": "6.10", "status": "affected"}, {"version": "0", "lessThan": "6.10", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.115", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.59", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.13", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.12.115"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.18.59"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "7.2.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/32751946f9b3e502e3d6e42d98b343473112f887"}, {"url": "https://git.kernel.org/stable/c/029770f5badedc0f0ff85fc45e24785cbbee4a67"}, {"url": "https://git.kernel.org/stable/c/68e6ab180cfb6dfa79652f41ed7899a6d4cf5438"}, {"url": "https://git.kernel.org/stable/c/89bab1dba8a0167ef0d819e0f55b6bafa038e87f"}], "title": "ring-buffer: Fix false warning in ring_buffer_map_get_reader()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/trace/ring_buffer.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "32751946f9b3e502e3d6e42d98b343473112f887", "status": "affected", "version": "117c39200d9d760cbd5944bb89efb7b9c51965aa", "versionType": "git"}, {"lessThan": "029770f5badedc0f0ff85fc45e24785cbbee4a67", "status": "affected", "version": "117c39200d9d760cbd5944bb89efb7b9c51965aa", "versionType": "git"}, {"lessThan": "68e6ab180cfb6dfa79652f41ed7899a6d4cf5438", "status": "affected", "version": "117c39200d9d760cbd5944bb89efb7b9c51965aa", "versionType": "git"}, {"lessThan": "89bab1dba8a0167ef0d819e0f55b6bafa038e87f", "status": "affected", "version": "117c39200d9d760cbd5944bb89efb7b9c51965aa", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/trace/ring_buffer.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.10"}, {"lessThan": "6.10", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.115", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.59", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.13", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nring-buffer: Fix false warning in ring_buffer_map_get_reader()\n\nThe mmap reader can warn when it catches up with a writer that is still\ncommitting events. rb_get_reader_page() returns NULL in this case, but\nring_buffer_map_get_reader() treats that result as an error.\n\nThe initial rb_per_cpu_empty() check filters out an empty buffer, but it\ndoes not guarantee that the next reader page has committed data. Writers\ndo not take reader_lock and can advance commit_page before publishing the\ncommitted length on the new page. rb_get_reader_page() can swap to that\npage, catch up with the writer and return NULL.\n\nHandle NULL through the existing no-data exit without warning. Remove the\ncaller's reader_page == commit_page check as well, since the reader-page\nhelper already handles that case. The existing metadata update and return\npath remain in place."}], "id": "CVE-2026-99158", "lastModified": "2026-10-30T13:21:49.637", "metrics": {}, "published": "2026-10-28T11:17:36.050", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/029770f5badedc0f0ff85fc45e24785cbbee4a67"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/32751946f9b3e502e3d6e42d98b343473112f887"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/68e6ab180cfb6dfa79652f41ed7899a6d4cf5438"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/89bab1dba8a0167ef0d819e0f55b6bafa038e87f"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: Denial of Service via false warning in memory-mapped ring buffer", "id": "2562751", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2562751"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-617", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nring-buffer: Fix false warning in ring_buffer_map_get_reader()\nThe mmap reader can warn when it catches up with a writer that is still\ncommitting events. rb_get_reader_page() returns NULL in this case, but\nring_buffer_map_get_reader() treats that result as an error.\nThe initial rb_per_cpu_empty() check filters out an empty buffer, but it\ndoes not guarantee that the next reader page has committed data. Writers\ndo not take reader_lock and can advance commit_page before publishing the\ncommitted length on the new page. rb_get_reader_page() can swap to that\npage, catch up with the writer and return NULL.\nHandle NULL through the existing no-data exit without warning. Remove the\ncaller's reader_page == commit_page check as well, since the reader-page\nhelper already handles that case. The existing metadata update and return\npath remain in place.", "A flaw was found in the Linux kernel's ring buffer component. When a reader process accessing memory-mapped trace data catches up with a concurrent writer still committing events, the kernel incorrectly treats the temporary absence of data as an error and triggers a kernel warning. A local user could trigger this condition during simultaneous read and write operations, potentially causing a Denial of Service (DoS) on systems configured to panic on kernel warnings."], "name": "CVE-2026-99158", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-28T10:35:11Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99158\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99158\nhttps://git.kernel.org/stable/c/029770f5badedc0f0ff85fc45e24785cbbee4a67\nhttps://git.kernel.org/stable/c/68e6ab180cfb6dfa79652f41ed7899a6d4cf5438\nhttps://git.kernel.org/stable/c/89bab1dba8a0167ef0d819e0f55b6bafa038e87f"], "statement": "This vulnerability is rated as having Moderate impact because exploitation requires local administrative privileges to interact with kernel tracing and service disruption occurs only on hosts explicitly set to treat warnings as fatal kernel panics. In standard Red Hat Enterprise Linux configurations, warning events do not crash the operating system, so a race between concurrent trace reading and writing generates a non-fatal diagnostic report. As a result, unprivileged users cannot exploit this behavior to cause a system outage or compromise system confidentiality or integrity.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[117c39200d9d760cbd5944bb89efb7b9c51965aa,029770f5badedc0f0ff85fc45e24785cbbee4a67)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[117c39200d9d760cbd5944bb89efb7b9c51965aa,68e6ab180cfb6dfa79652f41ed7899a6d4cf5438)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[117c39200d9d760cbd5944bb89efb7b9c51965aa,89bab1dba8a016e0d819e0f55b6bafa038e87f)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.10"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.10)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.59,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.13,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[117c39200d9d760cbd5944bb89efb7b9c51965aa,029770f5badedc0f0ff85fc45e24785cbbee4a67)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[117c39200d9d760cbd5944bb89efb7b9c51965aa,68e6ab180cfb6dfa79652f41ed7899a6d4cf5438)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[117c39200d9d760cbd5944bb89efb7b9c51965aa,89bab1dba8a016e0d819e0f55b6bafa038e87f)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.10"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.10)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.59,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.13,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-28T12:15:14.880415+00:00", "updated": "2026-11-02T04:00:09.335179+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}