SB20260824237 - Improper Initialization in Linux kernel trace

Description

This security bulletin contains information about 1 vulnerability.

1) Improper Initialization (CVE-ID: CVE-2026-74602)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper initialization in rb_allocate_cpu_buffer() in the ring buffer subsystem when freeing ring-buffer reader pages for sub-buffers larger than PAGE_SIZE. A local user can trigger allocation and freeing of a crafted ring buffer configuration to cause a denial of service.

The issue affects ring buffers with sub-buffers larger than PAGE_SIZE.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/2e37f2bf111429fbfa4d985b12df3ba496ca70aa
• https://git.kernel.org/stable/c/3b3e0a6ee5bb3ac000f135beef26b2b7ed1a771a
• https://git.kernel.org/stable/c/6d014e44b68ddd43f71288d2a4dbb1a259869149
• https://git.kernel.org/stable/c/7c620d89bae1a926ab7d626600285d3516c9f3c4