The Linux kernel ring buffer had a race condition where the trace_buffer subbuf_size was read locklessly in ring_buffer_read_page() and ring_buffer_read_start(), while it could be resized concurrently by ring_buffer_subbuf_order_set(). This could lead to inconsistent or corrupted reads. The fix involves using the bpage::order field instead of trace_buffer::subbuf_size in read functions and synchronizing access with the trace_buffer mutex to prevent races during buffer order modifications. The obsolete subbuf_size field was removed, and new accessor functions were introduced to safely obtain buffer sizes.

The vulnerability could cause inconsistent or corrupted reads from the ring buffer due to a race condition between reading and resizing the sub-buffer size. This could potentially affect kernel tracing or debugging functionality relying on the ring buffer. No information about exploitation or broader impact is provided.

A fix has been implemented in the Linux kernel source code that removes the unsafe subbuf_size field, introduces proper synchronization with a mutex, and uses safer accessors for buffer sizes. Users should update to the fixed kernel version once available. Patch status is not explicitly confirmed; check the vendor advisory or Linux kernel mailing lists for the specific fixed version and apply the update accordingly.