Improper resource shutdown or release in Linux kernel - CVE-2026-90273

Vulnerability identifier: #VU151217

CSH Severity: Low

CVSS v4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-90273

CWE-ID: CWE-404

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to cause active configuration reference leaks.

The vulnerability exists due to improper resource shutdown or release in the ETMv4 CoreSight perf enable path when branch broadcast is selected but unsupported by the hardware or hardware enablement fails. A local user can enable a perf event that encounters either error condition to cause active configuration reference leaks.

Linux kernel
Debian Linux
Ubuntu
linux (Ubuntu package)
linux-aws (Ubuntu package)
linux-gcp (Ubuntu package)
linux-oracle (Ubuntu package)
linux-ibm (Ubuntu package)
linux-hwe-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)
linux (Debian package)

Install security update from vendor's repository.

linux (Ubuntu package) - update to 7.0.0-42.42
linux-aws (Ubuntu package) - update to 7.0.0-1016.17
linux-gcp (Ubuntu package) - update to 7.0.0-1016.18
linux-oracle (Ubuntu package) - update to 7.0.0-1015.16
linux-ibm (Ubuntu package) - update to 7.0.0-1017.17
linux-hwe-7.0 (Ubuntu package) - update to 7.0.0-42.42~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1017.17
linux (Debian package) - update to 6.12.115-2

• https://git.kernel.org/stable/c/0a47f0be6557b4a851addd430383a4dc7ee08752
• https://git.kernel.org/stable/c/7e4f2702bbadbde887a5d8897297720a7f037ee5

• Improper resource shutdown or release in Linux kernel hwtracing coresight driver
• Debian update for linux
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux, linux-aws, linux-gcp and more