Executive brief
The Linux kernel's Coresight ETM4X tracing driver fails to properly clean up resources in error conditions during performance monitoring enablement. This resource leak causes internal reference counts to not be decremented when certain error conditions occur, potentially affecting the reliability of the hardware tracing subsystem over time as resources are not properly released.
Technical details
A resource leak exists in the Coresight ETM4X kernel driver's perf enable path (etm4_enable_perf function). The vulnerability is a missing cleanup path where cscfg_csdev_disable_active_config() is not called in two error scenarios: when branch broadcast is selected but unsupported by hardware, and when etm4_enable_hw() fails. This causes config_desc->active_cnt to leak. The fix moves configuration setup and error handling into etm4_enable_perf from etm4_parse_event_config, ensuring proper cleanup in all error paths by calling cscfg_csdev_disable_active_config() before returning errors. No user authentication or special privileges are required; any user able to use perf tracing can trigger this.
Affected products
- Linux Linux Kernel Linux kernel versions prior to the fix (commit 0a47f0be6557b4a851addd430383a4dc7ee08752)
Timeline
- 2026-09-17: disclosed: CVE-2026-90273 published
- 2026-08-07: patched: Fix committed by Suzuki K Poulose