CVE-2026-98057

Summary

In the Linux kernel, the following vulnerability has been resolved:

ring-buffer: Add checking nr_subbufs to persistent ring buffer validation

Sashiko reported that the code was using meta->nr_subbufs without making sure that it matched the nr_pages + 1 on data that was assuming the two were the same.

Add a check to the persistent ring buffer validation code to make sure that the saved nr_subbufs matches what we expect.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux3ec743d558f111d8999aea24577ba66c65ee2eeb < f0467190e6a9fc61e343c8064ef16aad513788c3affected
LinuxLinuxf5b95f1fa2ef3a03f49eeec658ba97e721412b32 < 69d502457e3f76142f7fcf6e2625e80e0ce8a60faffected
LinuxLinuxf5b95f1fa2ef3a03f49eeec658ba97e721412b32 < 6c001a62c34f13fe1c6a24304c289b387d9e697daffected
LinuxLinux0d547a6f5e8fad26ebc12f501d7d19fccdbad6bfaffected
LinuxLinux6.12.16 < 6.12.111affected
LinuxLinux6.13.4 < 6.14affected
LinuxLinux6.14affected
LinuxLinux0 < 6.14unaffected
LinuxLinux6.12.111 <= 6.12.*unaffected
LinuxLinux7.2.7 <= 7.2.*unaffected
LinuxLinux7.3-rc2 <= *unaffected

Weaknesses

References