Bug 2562751 (CVE-2026-99158) - CVE-2026-99158 kernel: kernel: Denial of Service via false warning in memory-mapped ring buffer
Summary: CVE-2026-99158 kernel: kernel: Denial of Service via false warning in memory-...
Keywords:
Status: NEW
Alias: CVE-2026-99158
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-28 11:03 UTC by OSIDB Bzimport
Modified: 2026-11-01 15:27 UTC (History)
17 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-10-28 11:03:40 UTC
In the Linux kernel, the following vulnerability has been resolved:

ring-buffer: Fix false warning in ring_buffer_map_get_reader()

The mmap reader can warn when it catches up with a writer that is still
committing events. rb_get_reader_page() returns NULL in this case, but
ring_buffer_map_get_reader() treats that result as an error.

The initial rb_per_cpu_empty() check filters out an empty buffer, but it
does not guarantee that the next reader page has committed data. Writers
do not take reader_lock and can advance commit_page before publishing the
committed length on the new page. rb_get_reader_page() can swap to that
page, catch up with the writer and return NULL.

Handle NULL through the existing no-data exit without warning. Remove the
caller's reader_page == commit_page check as well, since the reader-page
helper already handles that case. The existing metadata update and return
path remain in place.


Note You need to log in before you can comment on or make changes to this bug.