CVE-2026-89748 tracing: Fix retry exhaustion in simple ring buffer reader swap
A logic error in the Linux kernel tracing ring buffer reader swap can cause data corruption and denial of service due to incorrect retry counter handling.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-89748?
CVE-2026-89748 is a high-severity vulnerability in Linux, published on 11 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
tracing: Fix retry exhaustion in simple ring buffer reader swap
simple_ring_buffer_swap_reader_page() starts with retry set to 8 and post-decrements it only after a failed link replacement. On the final attempt, a successful replacement leaves retry at zero, while a failed replacement leaves it at -1.
The current !retry test reverses both outcomes. It returns an error after a successful final replacement, leaving the link update complete but the reader bookkeeping unfinished. After a failed final replacement, it falls through and updates the head and reader pointers as though the replacement succeeded, which can corrupt the ring.
Treat only a negative counter as exhaustion and return the documented -EBUSY error.
Which versions are affected by CVE-2026-89748?
How do I fix CVE-2026-89748?
Apply the vendor's patch.
Is CVE-2026-89748 being exploited?
There is no known exploitation of CVE-2026-89748 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-89748, GHSA-r5q3-2xvw-rm37, UBUNTU-CVE-2026-89748.