CVE-2026-99159

In the Linux kernel, the following vulnerability has been resolved:

ring-buffer: Fix the sub-buffer array base in rb meta subbuf idx()

On a persistent ring buffer, rb meta subbuf idx() can return an index one sub-buffer too high. rb setup ids meta page() then fills subbuf ids[] shifted by one and leaves subbuf ids[0] NULL, which rb map vma() dereferences when userspace maps trace pipe raw. rb update meta reader() writes two such indices into meta->buffers[], which rb cpu meta valid() would reject on the next boot, discarding the previous boot's trace.

A CPU's sub-buffer array starts after its meta header and the nr subbufs integers that follow, aligned up to a sub-buffer. rb meta subbuf idx() inverts that calculation but skips only the integers, not the header, so its base is one sub-buffer low whenever the omitted header size crosses the alignment boundary.

Invert the calculation with rb subbufs from meta() rather than repeating it. rb range buffer() maps an index back to an address through the same helper, so the two directions can no longer disagree.