CVE-2026-99159

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99159", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.397Z", "datePublished": "2026-10-28T10:35:12.520Z", "dateUpdated": "2026-10-30T12:42:25.874Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:42:25.874Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nring-buffer: Fix the sub-buffer array base in rb_meta_subbuf_idx()\n\nOn a persistent ring buffer, rb_meta_subbuf_idx() can return an index one\nsub-buffer too high. rb_setup_ids_meta_page() then fills subbuf_ids[]\nshifted by one and leaves subbuf_ids[0] NULL, which __rb_map_vma()\ndereferences when userspace maps trace_pipe_raw. rb_update_meta_reader()\nwrites two such indices into meta->buffers[], which rb_cpu_meta_valid()\nwould reject on the next boot, discarding the previous boot's trace.\n\nA CPU's sub-buffer array starts after its meta header and the nr_subbufs\nintegers that follow, aligned up to a sub-buffer. rb_meta_subbuf_idx()\ninverts that calculation but skips only the integers, not the header, so\nits base is one sub-buffer low whenever the omitted header size crosses\nthe alignment boundary.\n\nInvert the calculation with rb_subbufs_from_meta() rather than repeating\nit. rb_range_buffer() maps an index back to an address through the same\nhelper, so the two directions can no longer disagree."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/trace/ring_buffer.c"], "versions": [{"version": "b14d032973d4e6c36e025e96ea3437de53d072d9", "lessThan": "0c0cf2240bb5ca5704ea932ba66ee54f43173915", "status": "affected", "versionType": "git"}, {"version": "b14d032973d4e6c36e025e96ea3437de53d072d9", "lessThan": "2f1248b728b56d583ea454fedf239550c49f7b18", "status": "affected", "versionType": "git"}, {"version": "b14d032973d4e6c36e025e96ea3437de53d072d9", "lessThan": "7469b3585ef5f65840d467d2caa811a9098c84b9", "status": "affected", "versionType": "git"}, {"version": "b14d032973d4e6c36e025e96ea3437de53d072d9", "lessThan": "25132363c723afc39aace8b098f547ab4a0ea759", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/trace/ring_buffer.c"], "versions": [{"version": "6.12", "status": "affected"}, {"version": "0", "lessThan": "6.12", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.115", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.59", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.13", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.12.115"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.18.59"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "7.2.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/0c0cf2240bb5ca5704ea932ba66ee54f43173915"}, {"url": "https://git.kernel.org/stable/c/2f1248b728b56d583ea454fedf239550c49f7b18"}, {"url": "https://git.kernel.org/stable/c/7469b3585ef5f65840d467d2caa811a9098c84b9"}, {"url": "https://git.kernel.org/stable/c/25132363c723afc39aace8b098f547ab4a0ea759"}], "title": "ring-buffer: Fix the sub-buffer array base in rb_meta_subbuf_idx()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/trace/ring_buffer.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "0c0cf2240bb5ca5704ea932ba66ee54f43173915", "status": "affected", "version": "b14d032973d4e6c36e025e96ea3437de53d072d9", "versionType": "git"}, {"lessThan": "2f1248b728b56d583ea454fedf239550c49f7b18", "status": "affected", "version": "b14d032973d4e6c36e025e96ea3437de53d072d9", "versionType": "git"}, {"lessThan": "7469b3585ef5f65840d467d2caa811a9098c84b9", "status": "affected", "version": "b14d032973d4e6c36e025e96ea3437de53d072d9", "versionType": "git"}, {"lessThan": "25132363c723afc39aace8b098f547ab4a0ea759", "status": "affected", "version": "b14d032973d4e6c36e025e96ea3437de53d072d9", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/trace/ring_buffer.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.12"}, {"lessThan": "6.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.115", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.59", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.13", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nring-buffer: Fix the sub-buffer array base in rb_meta_subbuf_idx()\n\nOn a persistent ring buffer, rb_meta_subbuf_idx() can return an index one\nsub-buffer too high. rb_setup_ids_meta_page() then fills subbuf_ids[]\nshifted by one and leaves subbuf_ids[0] NULL, which __rb_map_vma()\ndereferences when userspace maps trace_pipe_raw. rb_update_meta_reader()\nwrites two such indices into meta->buffers[], which rb_cpu_meta_valid()\nwould reject on the next boot, discarding the previous boot's trace.\n\nA CPU's sub-buffer array starts after its meta header and the nr_subbufs\nintegers that follow, aligned up to a sub-buffer. rb_meta_subbuf_idx()\ninverts that calculation but skips only the integers, not the header, so\nits base is one sub-buffer low whenever the omitted header size crosses\nthe alignment boundary.\n\nInvert the calculation with rb_subbufs_from_meta() rather than repeating\nit. rb_range_buffer() maps an index back to an address through the same\nhelper, so the two directions can no longer disagree."}], "id": "CVE-2026-99159", "lastModified": "2026-10-30T13:21:49.740", "metrics": {}, "published": "2026-10-28T11:17:36.160", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0c0cf2240bb5ca5704ea932ba66ee54f43173915"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/25132363c723afc39aace8b098f547ab4a0ea759"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2f1248b728b56d583ea454fedf239550c49f7b18"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7469b3585ef5f65840d467d2caa811a9098c84b9"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: Denial of Service via null pointer dereference in persistent ring buffer", "id": "2562686", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2562686"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nring-buffer: Fix the sub-buffer array base in rb_meta_subbuf_idx()\nOn a persistent ring buffer, rb_meta_subbuf_idx() can return an index one\nsub-buffer too high. rb_setup_ids_meta_page() then fills subbuf_ids[]\nshifted by one and leaves subbuf_ids[0] NULL, which __rb_map_vma()\ndereferences when userspace maps trace_pipe_raw. rb_update_meta_reader()\nwrites two such indices into meta->buffers[], which rb_cpu_meta_valid()\nwould reject on the next boot, discarding the previous boot's trace.\nA CPU's sub-buffer array starts after its meta header and the nr_subbufs\nintegers that follow, aligned up to a sub-buffer. rb_meta_subbuf_idx()\ninverts that calculation but skips only the integers, not the header, so\nits base is one sub-buffer low whenever the omitted header size crosses\nthe alignment boundary.\nInvert the calculation with rb_subbufs_from_meta() rather than repeating\nit. rb_range_buffer() maps an index back to an address through the same\nhelper, so the two directions can no longer disagree.", "A flaw was found in the Linux kernel's ring-buffer subsystem. A local user can cause a Denial of Service (DoS) by crashing the system when interacting with persistent ring buffers. Due to an incorrect sub-buffer index calculation, the kernel leaves an entry uninitialized, resulting in a null pointer dereference when userspace maps the raw trace pipe interface."], "name": "CVE-2026-99159", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-28T10:35:12Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99159\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99159\nhttps://git.kernel.org/stable/c/25132363c723afc39aace8b098f547ab4a0ea759\nhttps://git.kernel.org/stable/c/2f1248b728b56d583ea454fedf239550c49f7b18\nhttps://git.kernel.org/stable/c/7469b3585ef5f65840d467d2caa811a9098c84b9"], "statement": "This vulnerability is evaluated as a Moderate impact because exploitation requires local access with elevated administrative privileges to configure and map tracing buffers, restricting the potential consequence to a system denial of service. In standard Red Hat Enterprise Linux environments, persistent ring buffer functionality is not enabled by default and access to tracefs interfaces is restricted to privileged accounts. Consequently, unprivileged users cannot trigger the crash, and risk is confined to systems where persistent tracing has been explicitly configured.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b14d032973d4e6c36e025e96ea3437de53d072d9,2f1248b728b56d583ea454fedf239550c49f7b18)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b14d032973d4e6c36e025e96ea3437de53d072d9,7469b3585ef5f65840d467d2caa811a9098c84b9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b14d032973d4e6c36e025e96ea3437de53d072d9,25132363c723afc39aace8b098f547ab4a0ea759)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.12"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.12)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.59,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.13,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b14d032973d4e6c36e025e96ea3437de53d072d9,2f1248b728b56d583ea454fedf239550c49f7b18)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b14d032973d4e6c36e025e96ea3437de53d072d9,7469b3585ef5f65840d467d2caa811a9098c84b9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[b14d032973d4e6c36e025e96ea3437de53d072d9,25132363c723afc39aace8b098f547ab4a0ea759)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.12"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.12)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.59,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.13,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-28T12:45:16.180448+00:00", "updated": "2026-11-02T04:30:16.862887+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}