SB20260812362 - Missing Release of Resource after Effective Lifetime in Linux kernel trace

Description

This security bulletin contains information about 1 vulnerability.

1) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-68175)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a resource leak in the mmiotrace tracer trace_pipe handling when closing the trace_pipe file with the mmiotrace tracer active. A local user can repeatedly open and close trace_pipe to cause a denial of service.

If the trace_pipe is read to completion, the resources are cleaned up; repeated partial reads such as reading a single line can trigger a large leak.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/594e1cf3f736779a535873fd5988162d827bfe4f
• https://git.kernel.org/stable/c/c1d87e724ae55e781b7cc7ccafb34d9e668582b2
• https://git.kernel.org/stable/c/cb459fec4f7b13caf646101ff076e94ef38434d8
• https://git.kernel.org/stable/c/cf5a82bef623b969a609f2b7e392d06dbae34aa6
• https://git.kernel.org/stable/c/f9e6dfe341fb31c95b9655eb6b1db8b3ae090817