CVE-2026-68175 Linux CVE debrief

Who should care

Linux system administrators and users of the mmiotrace tracer should be aware of this issue and take steps to address the resource leak. This includes applying kernel updates, monitoring system resource usage, and reviewing system logs for signs of the leak. Additionally, security teams and vulnerability management teams should review the issue and plan for mitigation and remediation efforts.

Technical summary

The mmiotrace tracer in the Linux kernel had a resource leak due to a missing .pipe_close function pointer. This was resolved by setting .pipe_close to mmio_close. The leak could be triggered by running 'head -n 1 /sys/kernel/tracing/trace_pipe' repeatedly, causing a massive leak. To address this, apply kernel updates and monitor system resource usage. The issue was caused by a missing .pipe_close function pointer in the mmiotrace tracer, leading to leaked header_iter allocations and stale pci_dev references. The mmiotrace tracer was added in 2008 but did not have a .pipe_close function pointer until 2009.

Defensive priority

Apply kernel updates to address resource leak in mmiotrace tracer.

Recommended defensive actions

• Apply kernel updates to address resource leak in mmiotrace tracer.
• Inventory Linux systems for mmiotrace tracer usage.
• Monitor for excessive resource usage on Linux systems.
• Review system logs for signs of resource leaks.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The mmiotrace tracer was added in 2008 but did not have a .pipe_close function pointer until 2009. The tracer's .pipe_close was not updated, causing resource leaks when trace_pipe was closed. To verify, review the Linux kernel source code for mmiotrace implementation and check for evidence of resource leaks in tracing logs. Defensive verification involves monitoring for excessive resource usage on Linux systems and reviewing system logs for signs of the leak.

Official resources