All vulnerabilities
CVE-2026-99160

Linux: ring-buffer: Do not show buffer_meta for CPUs without a buffer

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in8512d0312cc0ea83ca4511b164c29a138bbb0c21Also 3f23cae09a4677a3f7c163a68388512cb231ff22CVE List
Published28 Oct 2026Updated 28 Oct 2026CVE List

What fixes it

  • 8512d0312cc0ea83ca4511b164c29a138bbb0c21LinuxCVE List
  • 3f23cae09a4677a3f7c163a68388512cb231ff22LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

ring-buffer: Do not show buffer_meta for CPUs without a buffer

The per_cpu/cpuN/buffer_meta files are created for every possible CPU, but buffer->buffers[cpu] is only allocated once that CPU comes online. Reading the file of a CPU that never came online dereferences a NULL cpu_buffer in rbm_start().

Fail the open with -ENODEV when the CPU has no buffer, as the other per CPU ring buffer interfaces do.

Text from CVE List

Affected versions 8

  • Linuxaffected: 950032ffcee7a43c960951940059afc5a2bdbcbc before 8512d0312cc0ea83ca4511b164c29a138bbb0c21CVE List
  • Linuxaffected: 950032ffcee7a43c960951940059afc5a2bdbcbc before ae670c1a24fb5ffb167f26358cf47a5f0abbd670CVE List
  • Linuxaffected: 950032ffcee7a43c960951940059afc5a2bdbcbc before 3f23cae09a4677a3f7c163a68388512cb231ff22CVE List
  • Linuxaffected: 6.12CVE List
  • Linuxunaffected: all versions before 6.12CVE List
  • Linuxunaffected: 6.18.59 through 6.18.*CVE List
  • Linuxunaffected: 7.2.13 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 3