CVE-2026-74601: ring-buffer: Use current_context for safe per-CPU buffer swap

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ring-buffer: Use current_context for safe per-CPU buffer swap

The ring_buffer_swap_cpu() function currently checks the per-CPU
committing counter to determine if a buffer is actively being written to
before performing the swap. However, there exists a race window where
this check can be bypassed:

    ring_buffer_lock_reserve
        cpu_buffer = buffer->buffers[cpu];       // cpu_buffer_a
        rb_reserve_next_event
            rb_start_commit // inc committing
            if (unlikely(READ_ONCE(cpu_buffer->buffer) != buffer)) {...}
            __rb_reserve_next
                rb_move_tail
                    rb_end_commit(cpu_buffer);   // dec committing => 0
                    /* interrupt hits here, successfully swaps! */
                    local_inc(&cpu_buffer->committing);

    ring_buffer_unlock_commit
        cpu_buffer = buffer->buffers[cpu];      // cpu_buffer_b
        rb_commit
            rb_end_commit
            RB_WARN_ON(cpu_buffer, !local_read(&cpu_buffer->committing))
                                                // triggers warning

The committing counter can temporarily drop to 0 during a single write
operation (within rb_move_tail), creating a window where swap can
succeed even though the write is still in progress. This leads to
inconsistent buffer state and triggers the RB_WARN_ON in rb_commit().

Replace the committing counter check with current_context checks, which
are set at the entry of ring_buffer_lock_reserve() and remain valid
throughout the entire write operation, providing a reliable indicator of
buffer busy state during swap.

The Linux kernel CVE team has assigned CVE-2026-74601 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.5 with commit 4239c38fe0b3847e1e6d962c74b41b08ba0e2990 and fixed in 6.18.45 with commit 5b926fb04cb9ef3156dcf88c69a59d3d1a1c4f9f
	Issue introduced in 4.5 with commit 4239c38fe0b3847e1e6d962c74b41b08ba0e2990 and fixed in 7.1.9 with commit 5e6e2a18c20e88167d414f666032792e8bf19b80
	Issue introduced in 4.5 with commit 4239c38fe0b3847e1e6d962c74b41b08ba0e2990 and fixed in 7.2 with commit f27bdc43077e4fcb5557dfc315ee8d91e741f483

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-74601
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	kernel/trace/ring_buffer.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/5b926fb04cb9ef3156dcf88c69a59d3d1a1c4f9f
	https://git.kernel.org/stable/c/5e6e2a18c20e88167d414f666032792e8bf19b80
	https://git.kernel.org/stable/c/f27bdc43077e4fcb5557dfc315ee8d91e741f483