---
id: CVE-2026-99158
title: 'ring-buffer: Fix false warning in ring_buffer_map_get_reader()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ring-buffer: Fix false warning in ring_buffer_map_get_reader()

  The mmap reader can warn when it catches up with a writer that is still
  committing events. rb_get_reader…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 117c39200d9d760cbd5944bb89efb7b9c51965aa <
    029770f5badedc0f0ff85fc45e24785cbbee4a67
  - >-
    Linux >= 117c39200d9d760cbd5944bb89efb7b9c51965aa <
    68e6ab180cfb6dfa79652f41ed7899a6d4cf5438
  - >-
    Linux >= 117c39200d9d760cbd5944bb89efb7b9c51965aa <
    89bab1dba8a0167ef0d819e0f55b6bafa038e87f
  - Linux 6.10
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T10:35:11.848Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-99158'
references:
  - url: 'https://git.kernel.org/stable/c/029770f5badedc0f0ff85fc45e24785cbbee4a67'
  - url: 'https://git.kernel.org/stable/c/68e6ab180cfb6dfa79652f41ed7899a6d4cf5438'
  - url: 'https://git.kernel.org/stable/c/89bab1dba8a0167ef0d819e0f55b6bafa038e87f'
tags:
  - cve.org
ingestedAt: '2026-10-28T11:09:40.397Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ring-buffer: Fix false warning in ring_buffer_map_get_reader()

The mmap reader can warn when it catches up with a writer that is still
committing events. rb_get_reader_page() returns NULL in this case, but
ring_buffer_map_get_reader() treats that result as an error.

The initial rb_per_cpu_empty() check filters out an empty buffer, but it
does not guarantee that the next reader page has committed data. Writers
do not take reader_lock and can advance commit_page before publishing the
committed length on the new page. rb_get_reader_page() can swap to that
page, catch up with the writer and return NULL.

Handle NULL through the existing no-data exit without warning. Remove the
caller's reader_page == commit_page check as well, since the reader-page
helper already handles that case. The existing metadata update and return
path remain in place.

## Affected

- `Linux >= 117c39200d9d760cbd5944bb89efb7b9c51965aa < 029770f5badedc0f0ff85fc45e24785cbbee4a67`
- `Linux >= 117c39200d9d760cbd5944bb89efb7b9c51965aa < 68e6ab180cfb6dfa79652f41ed7899a6d4cf5438`
- `Linux >= 117c39200d9d760cbd5944bb89efb7b9c51965aa < 89bab1dba8a0167ef0d819e0f55b6bafa038e87f`
- `Linux 6.10`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.