{"id":"CVE-2026-99159","kind":"vulnerability","aliases":["CVE-2026-99159"],"related":[],"title":"Linux kernel: persistent ring buffer index error can crash trace mapping","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nring-buffer: Fix the sub-buffer array base in rb_meta_subbuf_idx()\n\nOn a persistent ring buffer, rb_meta_subbuf_idx() can return an index one\nsub-buffer too high.  rb_setup_ids_meta_page() then fills subbuf_ids[]\nshifted by one and leaves subbuf_ids[0] NULL, which __rb_map_vma()\ndereferences when userspace maps trace_pipe_raw.  rb_update_meta_reader()\nwrites two such indices into meta->buffers[], which rb_cpu_meta_valid()\nwould reject on the next boot, discarding the previous boot's trace.\n\nA CPU's sub-buffer array starts after its meta header and the nr_subbufs\nintegers that follow, aligned up to a sub-buffer.  rb_meta_subbuf_idx()\ninverts that calculation but skips only the integers, not the header, so\nits base is one sub-buffer low whenever the omitted header size crosses\nthe alignment boundary.\n\nInvert the calculation with rb_subbufs_from_meta() rather than repeating\nit.  rb_range_buffer() maps an index back to an address through the same\nhelper, so the two directions can no longer disagree.","summary":"On a persistent ring buffer, the kernel computes one sub-buffer index too high, leaving a NULL pointer that is dereferenced when userspace maps trace_pipe_raw. The sources describe a crash on that mapping and loss of the previous boot's trace data, and do not describe code execution.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux-kernel","runtime","tracing"],"not_affected_if":["default-config"],"how_to_check":"- unknown","fix":"- Update to a Linux kernel release that includes the upstream commit 'ring-buffer: Fix the sub-buffer array base in rb_meta_subbuf_idx()'\n- unknown","status":"open","published_at":"2026-10-28T11:17:36+00:00","first_seen_at":"2026-10-28T11:32:36+00:00","triaged_at":"2026-10-28T11:35:49+00:00","updated_at":"2026-10-28T11:35:49+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-28T11:35:49Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel release that includes the upstream commit 'ring-buffer: Fix the sub-buffer array base in rb_meta_subbuf_idx()'\n- unknown","reach":"local","title":"Linux kernel: persistent ring buffer index error can crash trace mapping","impact":"low","summary":"On a persistent ring buffer, the kernel computes one sub-buffer index too high, leaving a NULL pointer that is dereferenced when userspace maps trace_pipe_raw. The sources describe a crash on that mapping and loss of the previous boot's trace data, and do not describe code execution.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","tracing"],"confidence":0.5,"needs_auth":"unknown","worst_case":"kernel NULL pointer dereference crashes the system","analyst_note":"Check the kernel.org stable commit for affected version ranges and whether the crash is reachable without privileges; the NVD entry gave no severity or version data.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Systems that use the kernel persistent ring buffer (tracing with a reserved memory region that survives reboot) and map trace_pipe_raw from userspace. Systems not using persistent ring buffer tracing are unlikely to be affected. unknown for fixed-version specifics.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000626,"input_tokens":3646,"output_tokens":522,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-99159':14A,17A '0':134C 'address':255C 'align':194C,232C 'array':92C,181C 'back':252C 'base':93C,218C 'boot':64B,168C,172C 'boundari':233C 'buffer':5A,27B,34B,86C,91C,103C,115C,157C,180C,200C,223C,248C 'calcul':207C,236C 'code':72B 'comput':30B 'cpu':160C,176C 'crash':9A,55B 'cross':230C 'cve':12A,15A 'data':67B 'derefer':140C 'dereferenc':44B 'describ':53B,71B 'direct':263C 'disagre':267C 'discard':169C 'error':7A 'execut':73B 'fill':124C 'fix':87C 'follow':79C,193C 'header':186C,215C,228C 'helper':259C 'high':37B,117C 'id':120C,126C,133C 'idx':98C,107C,204C 'index':6A,35B,111C,251C 'indic':154C 'integ':191C,212C 'invert':205C,234C 'kernel':2A,20B,29B,77C 'leav':38B,131C 'linux':1A,19B,76C 'linux-kernel':18B 'longer':266C 'loss':60B 'low':224C 'map':11A,47B,58B,138C,143C,249C 'meta':96C,105C,121C,149C,156C,161C,185C,202C,241C 'next':167C 'nr':189C 'null':40B,135C 'omit':227C 'one':31B,112C,129C,220C 'page':122C 'persist':3A,25B,101C 'pipe':49B,145C 'pointer':41B 'previous':63B,171C 'rang':247C 'rather':242C 'raw':50B,146C 'rb':95C,104C,118C,137C,147C,159C,201C,238C,246C 'reader':150C 'reject':164C 'repeat':244C 'resolv':83C 'return':109C 'ring':4A,26B,85C,102C 'ring-buff':84C 'runtim':21B 'setup':119C 'shift':127C 'size':229C 'skip':209C 'sourc':52B 'start':182C 'sub':33B,90C,114C,179C,199C,222C 'sub-buff':32B,89C,113C,178C,198C,221C 'subbuf':97C,106C,125C,132C,190C,203C,239C 'trace':10A,22B,48B,66B,144C,174C 'two':152C,262C 'updat':148C 'userspac':46B,142C 'valid':162C 'vma':139C 'vulner':80C 'whenev':225C 'would':163C 'write':151C","nicknames":[],"mitigations":[],"who_affected":"Systems that use the kernel persistent ring buffer (tracing with a reserved memory region that survives reboot) and map trace_pipe_raw from userspace. Systems not using persistent ring buffer tracing are unlikely to be affected. unknown for fixed-version specifics.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:36+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99159","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99159","severity":null,"published_at":"2026-10-28T11:17:36+00:00","modified_at":"2026-10-28T11:17:36+00:00","first_seen_at":"2026-10-28T11:32:36+00:00","fetched_at":"2026-10-28T11:32:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}