---
id: CVE-2026-43272
title: 'ring-buffer: Fix possible dereference of uninitialized pointer'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ring-buffer: Fix possible dereference of uninitialized pointer

  There is a pointer head_page in rb_meta_validate_events() which is not
  initialized at the beginning of a…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 5f3b6e839f3ceb8d6ef02231ba9b5aca71b8bf55 <
    a4afdff9c715af50cf6c3f2dc601932c2cea17a2
  - >-
    Linux >= 5f3b6e839f3ceb8d6ef02231ba9b5aca71b8bf55 <
    bc77986f3cb7476637052edf2d87137fa39f153d
  - >-
    Linux >= 5f3b6e839f3ceb8d6ef02231ba9b5aca71b8bf55 <
    d9942396845fef2369478c157b26738fe07142f6
  - >-
    Linux >= 5f3b6e839f3ceb8d6ef02231ba9b5aca71b8bf55 <
    f1547779402c4cd67755c33616b7203baa88420b
  - Linux 6.12
published: '2026-05-06'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T12:40:28.662Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-43272'
references:
  - url: 'https://git.kernel.org/stable/c/a4afdff9c715af50cf6c3f2dc601932c2cea17a2'
  - url: 'https://git.kernel.org/stable/c/bc77986f3cb7476637052edf2d87137fa39f153d'
  - url: 'https://git.kernel.org/stable/c/d9942396845fef2369478c157b26738fe07142f6'
  - url: 'https://git.kernel.org/stable/c/f1547779402c4cd67755c33616b7203baa88420b'
tags:
  - cve.org
epss: 0.0016
epssPercentile: 0.04781
ingestedAt: '2026-10-21T12:48:53.643Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ring-buffer: Fix possible dereference of uninitialized pointer

There is a pointer head_page in rb_meta_validate_events() which is not
initialized at the beginning of a function. This pointer can be dereferenced
if there is a failure during reader page validation. In this case the control
is passed to "invalid" label where the pointer is dereferenced in a loop.

To fix the issue initialize orig_head and head_page before calling
rb_validate_buffer.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

## Affected

- `Linux >= 5f3b6e839f3ceb8d6ef02231ba9b5aca71b8bf55 < a4afdff9c715af50cf6c3f2dc601932c2cea17a2`
- `Linux >= 5f3b6e839f3ceb8d6ef02231ba9b5aca71b8bf55 < bc77986f3cb7476637052edf2d87137fa39f153d`
- `Linux >= 5f3b6e839f3ceb8d6ef02231ba9b5aca71b8bf55 < d9942396845fef2369478c157b26738fe07142f6`
- `Linux >= 5f3b6e839f3ceb8d6ef02231ba9b5aca71b8bf55 < f1547779402c4cd67755c33616b7203baa88420b`
- `Linux 6.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.