CVE-2026-98057

A flaw of moderate impact was found in the Linux kernel's tracing ring buffer, affecting the kernel in Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2. The persistent ring buffer validation logic did not verify that the sub-buffer count (nr_subbufs) saved in the persistent metadata matched the expected page count (nr_pages + 1). A local attacker able to manipulate persistent ring buffer metadata could exploit this mismatch to trigger out-of-bounds memory operations when a saved tracing buffer is restored, potentially resulting in memory corruption or a denial of service. Red Hat rated this flaw Moderate severity with a CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), reflecting availability impact only; reliable exploitation requires privileged local control over persistent tracing configuration and reserved memory across reboots, and the available evidence does not establish a strong out-of-bounds write or privilege escalation primitive. Red Hat Enterprise Linux 6, 7, 8, and 9 (including kernel-rt) and the OpenShift Container Platform RHCOS images are not affected because the vulnerable code is not present in their kernels. For the affected Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2 streams, the fix has been deferred to a future scheduled kernel update; the residual risk is limited because exploitation requires local privileged access and a system configured to use the persistent tracing ring buffer feature with reserved memory.