CVE-2026-89747

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the tracing component when reading from trace pipe during a sub-buffer order change. Writing to buffer subbuf size kb triggers the ring buffer subbuf order set() function, which frees all sub-buffers of the ring buffer, including the reader page, and replaces them with new allocations. Because ring buffer peek() returns an event pointer after releasing the cpu buffer->reader lock, a race condition occurs if the sub-buffer order changes before peek next entry() calls ring buffer event length() and ring buffer event data(). This leads to the reader dereferencing memory that has already been freed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.