Executive brief
A vulnerability was identified in the Linux kernel's tracing subsystem, which is used by developers and system administrators to monitor system performance and behavior. Under specific conditions where the system fails to allocate memory for tracing data, the kernel might attempt to improperly free resources that were never successfully created. While this is a technical error in the kernel's internal management, it could potentially lead to system instability or crashes in specific scenarios.
Technical details
A vulnerability in `kernel/trace/tracing_map.c` in the Linux kernel involves an incorrect error handling path in `tracing_map_elt_alloc()`. When the allocation of tracing map elements fails, the code incorrectly calls `map->ops->elt_free()`, despite the fact that `map->ops->elt_alloc()` was never successfully executed. This violates the expected lifecycle of the tracing map elements and can lead to undefined behavior or kernel instability. The fix introduces a internal helper function `__tracing_map_elt_free()` to ensure that the high-level free operation is only called on successfully initialized objects. This issue affects kernels from version 4.17 onwards and has been patched in multiple stable branches including 5.10.y, 5.15.y, 6.1.y, and 6.6.y.
Affected products
- Linux Linux 4.17 to 6.14.y
Timeline
- 2026-05-21: other: Patch authored by Masami Hiramatsu
- 2026-07-19: disclosed: CVE published by kernel.org and NVD
References
- https://git.kernel.org/stable/c/1a150947f8480262a46c860f1acb9c6597ca7097
- https://git.kernel.org/stable/c/49332e49ad5b20262cc719b03d4123b9362de701
- https://git.kernel.org/stable/c/798183376d9d3e278a270ea0e75a5769c8f145d9
- https://git.kernel.org/stable/c/8f0f5c4fb9df0e19a341e0c6ed8dc4fda9124f03
- https://git.kernel.org/stable/c/b427e9f6d81c9341cba23ef92f860f99f830d91d
- https://git.kernel.org/stable/c/b559a218eece132de0c58d444877b5627cbee524
- https://git.kernel.org/stable/c/b6723339736320b2e1784258ad4490cec7aac11a