CVE-2026-89499 ring-buffer: Stop remote reader update when page swap fails
A race condition in the Linux kernel ring buffer allows a local attacker to cause a denial of service by triggering a page swap failure during high event load.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89499?
CVE-2026-89499 is a high-severity vulnerability in Linux, published on 11 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ring-buffer: Stop remote reader update when page swap fails
The remote swap_reader_page callback can return -EBUSY when the writer moves the head before the remote catches it, particularly during an event storm on a small buffer. __rb_get_reader_page_from_remote() currently warns about that failure but continues with the unchanged reader ID and rearranges the local page list as though the swap succeeded.
Handle the callback failure as a recoverable error. Report it with pr_warn_ratelimited() and return NULL. Callers already handle a NULL reader page as a failed attempt. This avoids splicing the same page as both the previous and new reader without flooding the log under contention.
Which versions are affected by CVE-2026-89499?
How do I fix CVE-2026-89499?
Apply the vendor's patch.
Is CVE-2026-89499 being exploited?
There is no known exploitation of CVE-2026-89499 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-89499, GHSA-5hxm-7wcj-79fv, UBUNTU-CVE-2026-89499.