CVE-2026-89502: ring-buffer: Free cpu_buffer::free_page with subbuf_order

Severity: unknown
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-11 · updated 2026-10-19

Description

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Free cpu_buffer::free_page with subbuf_order When sub-buffers use an order greater than 0, cpu_buffer->free_page is allocated with subbuf_order. Use the correct order for cpu_buffer->free_page.

Affected products

Linux kernel: 6.8 — fixed in 7.3

How to fix

Upgrade to a fixed version: Linux kernel 7.3. Check the vendor advisory for mitigations.

References

https://git.kernel.org/stable/c/234b1a72e9706fe20c08c96f4374ec8e83b934cb
https://git.kernel.org/stable/c/77275ccea06eaf297e8e6ac3fc830cb72086379a
https://git.kernel.org/stable/c/81063bbb16c4fcf0136c9117d5e49d3621dd6a1e
https://git.kernel.org/stable/c/8c1ecdcdea738efe0494af908f12c0ae3a97fffa

Get alerted when CVE-2026-89502 or the next vulnerability affects your stack