CVE-2026-97617

A moderate severity race condition flaw was found in the Linux kernel's ring buffer (tracing) subsystem, affecting the kernel in Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2. When ring_buffer_subbuf_order_set() changes the ring buffer sub-buffer order, it stores the new order before walking the CPUs and can return -EBUSY (because a user-mapped buffer has resizing disabled) only after the new order has already been published. Since __rb_map_vma() reads buffer->subbuf_order without holding buffer->mutex, a local user who can map the tracefs ring buffer can race an mmap of an already-mapped CPU buffer against the failing order change, causing the mapping to be sized with the new order and pages to be inserted past the sub-buffer into the VMA. This out-of-bounds mapping can result in memory corruption or a denial of service through a system crash. Red Hat rates the severity of this flaw as Moderate (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

Red Hat Enterprise Linux 6, 7, 8, and 9, and the OpenShift Container Platform CoreOS kernels, are not affected because the vulnerable code is not present in those kernels. Because exploitation requires local access with the ability to map the tracing ring buffer and to win a narrow race window between the mmap and the failing order change, and because the assessed impact is limited to availability with no established confidentiality or integrity impact, the fix for the affected products is deferred to a future planned update. Until the fix is delivered, the residual risk is local memory corruption or denial of service on systems where untrusted local users have access to tracefs ring buffer functionality.