CVE-2026-80730

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ring-buffer: Fix crash passing ERR_PTR to kthread_stop()

In test_ringbuffer()'s out_free cleanup loop, the check

`!rb_threads[cpu]` only catches NULL entries and misses entries that

hold an ERR_PTR.

rb_threads[] is static, so unassigned slots are NULL. But when

kthread_run_on_cpu() fails for a cpu, it stores ERR_PTR(-ENOMEM) (or

-EINTR) in rb_threads[cpu] before the creation loop jumps to out_free.

That entry is non-NULL, so the old `!ptr` check does not break, and the

cleanup proceeds to call kthread_stop() on the ERR_PTR. kthread_stop()

then dereferences the bogus pointer, crashing the kernel during the

late_initcall self-test.

crash logs:

BUG: kernel NULL pointer dereference, address: 000000000000001c

Oops: 0002 [#1] SMP NOPTI

CPU: 1 PID: 1 Comm: swapper/0 Not tainted 7.2.0-rc6-dirty #7 PREEMPT(lazy)

RIP: 0010:kthread_stop+0x2e/0x220

RBX: fffffffffffffff4

CR2: 000000000000001c

Call Trace:

<TASK>

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References