Unknown

CVE-2026-80876 — ring-buffer: Fix event length with forced 8-byte alignment

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix event length with forced 8-byte alignment When RB_FORCE_8BYTE_ALIGNMENT is true, rb_calculate_event_length() reserves the space of event->array[0] for placing the data length and rb_update_event() stores the data length in event->array[0] accordingly. As a result the whole event length will add extra 4 bytes for sizeof(event.array[0]) unconditionally. But ring_buffer_event_length() only subtracts the sizeof(event->array[0]) for events larger than RB_MAX_SMALL_DATA + sizeof(event->array[0]). As a result, small events on architectures with RB_FORCE_8BYTE_ALIGNMENT=true report a data length that is 4 bytes larger than expected. To fix it, add the RB_FORCE_8BYTE_ALIGNMENT as a condition to subtract the size of that length field whenever RB_FORCE_8BYTE_ALIGNMENT is true. This issue is observed in a riscv64 kernel with CONFIG_HAVE_64BIT_ALIGNED_ACCESS set to y, when we run ftrace selftest trace_marker_raw.tc, we get the weird log: for cases where the id is 1..100, the number of data field is 8*N, but once id exceeds 100, the number of data field becomes 8*N+4: # 1 buf: 58 00 00 00 80 5e d1 63 (number of data field is 8*1) ... # a buf: 58 ... (number of data field is 8*2) ... # 64 buf: 58 ... (number of data field is 8*13) # 65 buf: 58 ... (number of data field is 8*13+4) After applying this change, the number of data field keeps being 8*N+4 consistently.

Published Sep 4, 2026 · Updated Oct 15, 2026 · Sources: NIST National Vulnerability Database, CVE Program (cve.org) e CISA ADP · CNA: Linux

Low

Who exploits it and how urgent it is

A 0–100 score combining confirmed exploitation, ransomware and APT use, public exploits, EPSS and severity.

No exploitation signal in the sources consulted so far.

How the score was calculated

EPSS 0.2% (30-day exploitation probability)+2

The score orders the patch queue; it does not replace your asset context (internet exposure, criticality, compensating controls).

Triage

Is it exploited, how likely is exploitation, what does it touch, and how severe do the sources call it.

Exploitation

Not confirmed

Not in CISA KEV — an absence of record, not proof it is unexploited.

EPSS FIRST

0.22%

ahead of 12% of scored CVEs · Oct 26, 2026

Affects

Linux

CVSS base

—

Score not published yet.

Remediation

Fixes and mitigations documented by the sources — linked to the original advisory.

No fix documented by the sources we poll. That does not mean none exists: check the vendor advisory.

First 24 hours

Ordered from the record’s own fields — exposure first, because you cannot patch what you have not found. A rule-generated starting point.

Identify exposed assets running the affected vendor/product/version combinations (Linux Linux).
No fix documented in the sources: reduce exposure and monitor the vendor advisory.
Search available logs for exploit probes, errors and authentication anomalies.

Affected scope

Vendor, product and versions as the sources word them.

Vendor	Product	Versions	Status	Source
Linux	Linux	≥ 2271048d1b3b0aabf83d25b29c20646dcabedc05 and < 7c9f0ccf9f04142458d2ac3d39414f4acae242f0≥ 2271048d1b3b0aabf83d25b29c20646dcabedc05 and < 24c3fa71f9947b0e1f3b954db1b769b44140192e≥ 2271048d1b3b0aabf83d25b29c20646dcabedc05 and < 14057268e79654c3e8ea2c9b5204cb9644b2964d≥ 2271048d1b3b0aabf83d25b29c20646dcabedc05 and < dbcb8635b1eb7603818591cf745c7b1d714f7ac6≥ 2271048d1b3b0aabf83d25b29c20646dcabedc05 and < cfada73fabe2ccc06ec77fe2ceaa088689213326≥ 2271048d1b3b0aabf83d25b29c20646dcabedc05 and < ec5e96aee75d27779b9a860307679f13f33adb0c≥ 2271048d1b3b0aabf83d25b29c20646dcabedc05 and < 3a63a11897c7ba32d1be7a3fdbc48a8b01cf4992≥ 2271048d1b3b0aabf83d25b29c20646dcabedc05 and < c37e0a4b79a6bbb96ce5ffe279d7c001e20529e0 and 1 more version 2.6.34	Vulnerable	CVE Program (cve.org) e CISA ADP

EPSS over time FIRST

Oct 15, 2026 → Oct 26, 2026 · 11 reading(s) · max 0.22%

Detection

Read off the CVSS vector and the weakness class. Starting points, not tested rules.

Not enough vector or weakness data: use the affected application’s logs as a starting point.

application logs

Timeline

What happened to this CVE, newest first.

2026
Record published
Oct 15, 2026
Affected products added · linux/linux
Oct 15, 2026 · CVE Program (cve.org) e CISA ADP
Source status changed · → Received
Oct 15, 2026 · NIST National Vulnerability Database
Record created in this database
Oct 15, 2026 · NIST National Vulnerability Database
CVE published
Sep 4, 2026 · Linux

Source activity

Repeated readings are counted rather than listed.

1× Official description updated · Oct 15, 2026 – Oct 15, 2026

References

8 on the record

git.kernel.org/stable/c/7c9f0ccf9f04142458d2ac3d39414f4acae242f0
NIST National Vulnerability Database
git.kernel.org/stable/c/24c3fa71f9947b0e1f3b954db1b769b44140192e
NIST National Vulnerability Database
git.kernel.org/stable/c/dbcb8635b1eb7603818591cf745c7b1d714f7ac6
NIST National Vulnerability Database
git.kernel.org/stable/c/14057268e79654c3e8ea2c9b5204cb9644b2964d
NIST National Vulnerability Database
git.kernel.org/stable/c/ec5e96aee75d27779b9a860307679f13f33adb0c
NIST National Vulnerability Database
git.kernel.org/stable/c/cfada73fabe2ccc06ec77fe2ceaa088689213326
NIST National Vulnerability Database
git.kernel.org/stable/c/c37e0a4b79a6bbb96ce5ffe279d7c001e20529e0
NIST National Vulnerability Database
git.kernel.org/stable/c/3a63a11897c7ba32d1be7a3fdbc48a8b01cf4992
NIST National Vulnerability Database

Elsewhere on this site

Linux
every CVE for this vendor

Related CVEs (same products)

Unknown CVE-2026-99092 riscv: patch: fix handling of bpf-jit execmem addresses 21h
Unknown CVE-2026-99093 mm: don't schedule deferred kernel page table freeing while booting 21h
Unknown CVE-2026-99095 drm/vc4: drain the hangcheck timer and works on V3D unbind 21h
Unknown CVE-2026-99096 io_uring/register: don't exempt disabled rings from task restrictions 21h
Unknown CVE-2026-99097 tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper() 21h
Unknown CVE-2026-99098 dm-integrity: fix buffer overflow in inline mode with large tag size 21h

Not in any source we poll

Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.

No CVSS score published by NVD, the CNA, CISA or GitHub so far.
No fixed version, patch or mitigation documented.
No CISA SSVC assessment.
No CWE classification.
No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
No exploit packet captures, log samples, or incident case IDs supplied.

Answered from this record

Text assembled only from the fields above — no additional claims.

What should defenders know first?

CVE-2026-80876 is "ring-buffer: Fix event length with forced 8-byte alignment", rated Unknown. It affects Linux (Linux); versions are in the scope table. It is not in CISA KEV, which does not rule out exploitation. EPSS 0.22% estimates the probability of exploitation in 30 days; neither replaces your asset context. First verify whether exposed or business-critical assets run the affected versions, apply vendor fixes or mitigations, and preserve logs for review.

Comments

Moderated technical discussion. Read the community guidelines.

No comments yet.