CVE-2026-99160 ring-buffer: Do not show buffer_meta for CPUs without a buffer
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-99160?
CVE-2026-99160 is a vulnerability in Linux, published on 28 Oct 2026.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ring-buffer: Do not show buffer_meta for CPUs without a buffer
The per_cpu/cpuN/buffer_meta files are created for every possible CPU, but buffer->buffers[cpu] is only allocated once that CPU comes online. Reading the file of a CPU that never came online dereferences a NULL cpu_buffer in rbm_start().
Fail the open with -ENODEV when the CPU has no buffer, as the other per CPU ring buffer interfaces do.
Which versions are affected by CVE-2026-99160?
How do I fix CVE-2026-99160?
Upgrade to a fixed version.
Is CVE-2026-99160 being exploited?
There is no known exploitation of CVE-2026-99160 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-99160, DEBIAN-CVE-2026-99160, GHSA-pw95-h85m-gvhp, UBUNTU-CVE-2026-99160.