Executive brief
A flaw was found in the Linux kernel's tracepoint mechanism, which is used for monitoring system events. Under specific conditions like high memory pressure, the system could fail to clean up internal tracking data when a monitoring request fails. This results in a permanent performance penalty for all running tasks, as the system continues to perform unnecessary background checks for events that are no longer being monitored, lasting until the next reboot.
Technical details
A resource leak exists in `kernel/tracepoint.c` within the `tracepoint_add_func()` function. When a tracepoint transitions from 0 to 1 consumers, the kernel calls the subsystem's `regfunc()`. If a subsequent call to `func_add()` fails (e.g., due to -ENOMEM during `allocate_probes()`), the kernel previously returned an error without invoking the corresponding `unregfunc()`. For syscall tracepoints, this leaves `SYSCALL_TRACEPOINT` set on all tasks and keeps `sys_tracepoint_refcount` incremented. This causes every task to incur syscall entry/exit tracing overhead indefinitely. The fix ensures `unregfunc()` is called on the `func_add()` error path to maintain symmetry.
Affected products
- Linux Linux Kernel Fixed in 247ed8a, 2c5b8ee, 342829e, 7bcadb3, fad217e
Timeline
- 2026-05-28: advisory: NVD publication date
- 2026-05-28: patched: Resolved in various stable branches
References
- https://git.kernel.org/stable/c/247ed8a969f981bfba3112fd4bb441eaa6cef59c
- https://git.kernel.org/stable/c/2c5b8eeea006eb694c81631cd5713d494b80be90
- https://git.kernel.org/stable/c/342829e042ac00f3d68d442ea92873fb6683f494
- https://git.kernel.org/stable/c/7bcadb3c2bc1cf60690e931aadd35fb7bd646a49
- https://git.kernel.org/stable/c/fad217e16fded7f3c09f8637b0f6a224d58b5f2e