Missing Release of Resource after Effective Lifetime in Linux kernel - CVE-2026-68175
Published: August 12, 2026
Vulnerability identifier: #VU142133
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-68175
CWE-ID: CWE-772
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a resource leak in the mmiotrace tracer trace_pipe handling when closing the trace_pipe file with the mmiotrace tracer active. A local user can repeatedly open and close trace_pipe to cause a denial of service.
If the trace_pipe is read to completion, the resources are cleaned up; repeated partial reads such as reading a single line can trigger a large leak.
Affected software
Linux kernel
How to mitigate CVE-2026-68175
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
External References
- https://git.kernel.org/stable/c/594e1cf3f736779a535873fd5988162d827bfe4f
- https://git.kernel.org/stable/c/c1d87e724ae55e781b7cc7ccafb34d9e668582b2
- https://git.kernel.org/stable/c/cb459fec4f7b13caf646101ff076e94ef38434d8
- https://git.kernel.org/stable/c/cf5a82bef623b969a609f2b7e392d06dbae34aa6
- https://git.kernel.org/stable/c/f9e6dfe341fb31c95b9655eb6b1db8b3ae090817