CVE-2026-99160

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99160", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.397Z", "datePublished": "2026-10-28T10:35:13.341Z", "dateUpdated": "2026-10-30T12:42:26.948Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:42:26.948Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nring-buffer: Do not show buffer_meta for CPUs without a buffer\n\nThe per_cpu/cpuN/buffer_meta files are created for every possible CPU,\nbut buffer->buffers[cpu] is only allocated once that CPU comes online.\nReading the file of a CPU that never came online dereferences a NULL\ncpu_buffer in rbm_start().\n\nFail the open with -ENODEV when the CPU has no buffer, as the other\nper CPU ring buffer interfaces do."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/trace/ring_buffer.c"], "versions": [{"version": "950032ffcee7a43c960951940059afc5a2bdbcbc", "lessThan": "445bc0e0ed7b3f69b78a0fd8d3a8fdb4e20bc379", "status": "affected", "versionType": "git"}, {"version": "950032ffcee7a43c960951940059afc5a2bdbcbc", "lessThan": "8512d0312cc0ea83ca4511b164c29a138bbb0c21", "status": "affected", "versionType": "git"}, {"version": "950032ffcee7a43c960951940059afc5a2bdbcbc", "lessThan": "ae670c1a24fb5ffb167f26358cf47a5f0abbd670", "status": "affected", "versionType": "git"}, {"version": "950032ffcee7a43c960951940059afc5a2bdbcbc", "lessThan": "3f23cae09a4677a3f7c163a68388512cb231ff22", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/trace/ring_buffer.c"], "versions": [{"version": "6.12", "status": "affected"}, {"version": "0", "lessThan": "6.12", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.115", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.59", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.13", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.12.115"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.18.59"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "7.2.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/445bc0e0ed7b3f69b78a0fd8d3a8fdb4e20bc379"}, {"url": "https://git.kernel.org/stable/c/8512d0312cc0ea83ca4511b164c29a138bbb0c21"}, {"url": "https://git.kernel.org/stable/c/ae670c1a24fb5ffb167f26358cf47a5f0abbd670"}, {"url": "https://git.kernel.org/stable/c/3f23cae09a4677a3f7c163a68388512cb231ff22"}], "title": "ring-buffer: Do not show buffer_meta for CPUs without a buffer", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/trace/ring_buffer.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "445bc0e0ed7b3f69b78a0fd8d3a8fdb4e20bc379", "status": "affected", "version": "950032ffcee7a43c960951940059afc5a2bdbcbc", "versionType": "git"}, {"lessThan": "8512d0312cc0ea83ca4511b164c29a138bbb0c21", "status": "affected", "version": "950032ffcee7a43c960951940059afc5a2bdbcbc", "versionType": "git"}, {"lessThan": "ae670c1a24fb5ffb167f26358cf47a5f0abbd670", "status": "affected", "version": "950032ffcee7a43c960951940059afc5a2bdbcbc", "versionType": "git"}, {"lessThan": "3f23cae09a4677a3f7c163a68388512cb231ff22", "status": "affected", "version": "950032ffcee7a43c960951940059afc5a2bdbcbc", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/trace/ring_buffer.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.12"}, {"lessThan": "6.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.115", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.59", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.13", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nring-buffer: Do not show buffer_meta for CPUs without a buffer\n\nThe per_cpu/cpuN/buffer_meta files are created for every possible CPU,\nbut buffer->buffers[cpu] is only allocated once that CPU comes online.\nReading the file of a CPU that never came online dereferences a NULL\ncpu_buffer in rbm_start().\n\nFail the open with -ENODEV when the CPU has no buffer, as the other\nper CPU ring buffer interfaces do."}], "id": "CVE-2026-99160", "lastModified": "2026-10-30T13:21:49.843", "metrics": {}, "published": "2026-10-28T11:17:36.277", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3f23cae09a4677a3f7c163a68388512cb231ff22"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/445bc0e0ed7b3f69b78a0fd8d3a8fdb4e20bc379"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8512d0312cc0ea83ca4511b164c29a138bbb0c21"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ae670c1a24fb5ffb167f26358cf47a5f0abbd670"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: Denial of Service via null pointer dereference in ring buffer metadata", "id": "2562758", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2562758"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nring-buffer: Do not show buffer_meta for CPUs without a buffer\nThe per_cpu/cpuN/buffer_meta files are created for every possible CPU,\nbut buffer->buffers[cpu] is only allocated once that CPU comes online.\nReading the file of a CPU that never came online dereferences a NULL\ncpu_buffer in rbm_start().\nFail the open with -ENODEV when the CPU has no buffer, as the other\nper CPU ring buffer interfaces do.", "A flaw was found in the Linux kernel's ring buffer subsystem. A local user can exploit this vulnerability to cause a Denial of Service (DoS) by crashing the kernel. The issue occurs when reading ring buffer metadata files for a central processing unit (CPU) that has never come online, resulting in a null pointer dereference."], "name": "CVE-2026-99160", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-28T10:35:13Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99160\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99160\nhttps://git.kernel.org/stable/c/3f23cae09a4677a3f7c163a68388512cb231ff22\nhttps://git.kernel.org/stable/c/8512d0312cc0ea83ca4511b164c29a138bbb0c21\nhttps://git.kernel.org/stable/c/ae670c1a24fb5ffb167f26358cf47a5f0abbd670"], "statement": "This vulnerability is rated as Moderate impact because triggering it requires local access to the kernel tracing filesystem and results only in a system crash without permitting data disclosure or privilege escalation. In default Red Hat Enterprise Linux deployments, access to the tracefs hierarchy is restricted to privileged accounts, significantly limiting exposure to unprivileged users. Additionally, the issue only affects systems configured with possible CPU capacities where specific cores have never been brought online.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[950032ffcee7a43c960951940059afc5a2bdbcbc,8512d0312cc0ea83ca4511b164c29a138bbb0c21)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[950032ffcee7a43c960951940059afc5a2bdbcbc,ae670c1a24fb5ffb167f26358cf47a5f0abbd670)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[950032ffcee7a43c960951940059afc5a2bdbcbc,3f23cae09a4677a3f7c163a68388512cb231ff22)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.12"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.12)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.59,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.13,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[950032ffcee7a43c960951940059afc5a2bdbcbc,8512d0312cc0ea83ca4511b164c29a138bbb0c21)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[950032ffcee7a43c960951940059afc5a2bdbcbc,ae670c1a24fb5ffb167f26358cf47a5f0abbd670)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[950032ffcee7a43c960951940059afc5a2bdbcbc,3f23cae09a4677a3f7c163a68388512cb231ff22)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.12"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.12)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.59,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.13,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-28T13:45:07.022541+00:00", "updated": "2026-11-02T04:00:09.334390+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}