Local kernel memory disclosure via ring-buffer overflow

Out-of-bounds read in the Linux kernel ring buffer in 6.10 through 6.12.6 allows local users to read kernel memory or interrupt service. __rb_map_vma shifts the subbuffer count and subtracts an attacker-controlled mapping offset without first rejecting an overflowing page calculation, permitting a page index beyond the allocated slab. Triggering requires local access with permission to configure the tracing buffer and map its per-CPU trace_pipe_raw file; the published reproducer causes an eight-byte KASAN-detected read.