CVE-2026-46196 Overview
CVE-2026-46196 is a Linux kernel vulnerability in the tracepoint subsystem. The flaw resides in tracepoint_add_func(), which fails to call the matching ext->unregfunc() cleanup when func_add() returns an error during the 0 → 1 probe transition. Under memory pressure, allocate_probes() can return -ENOMEM, leaving regfunc() side effects in place without an installed probe. For syscall tracepoints, this leaks sys_tracepoint_refcount and sets SYSCALL_TRACEPOINT on every task, causing persistent syscall entry/exit overhead until reboot.
Critical Impact
Persistent kernel state leakage forcing every task to pay syscall trace overhead until the system is rebooted, with similar effects across other tracepoint subsystems.
Affected Products
- Linux kernel (tracepoint subsystem)
- Stable kernel branches referenced by commits 247ed8a, 2c5b8ee, 342829e, 7bcadb3, and fad217e
- Distributions shipping unpatched kernels with the affected tracepoint code path
Discovery Timeline
- 2026-05-28 - CVE-2026-46196 published to NVD
- 2026-05-28 - Last updated in NVD database
Technical Details for CVE-2026-46196
Vulnerability Analysis
The tracepoint infrastructure manages probe registration through a paired regfunc()/unregfunc() lifecycle. When a tracepoint transitions from zero to one active probe, tracepoint_add_func() first invokes the subsystem's ext->regfunc() callback to prepare global state. It then calls func_add() to install the probe into the active array.
The error path of func_add() does not call ext->unregfunc(). If func_add() fails after regfunc() succeeded, the cleanup is skipped. The subsystem's preparatory side effects persist with no installed consumer to justify them.
Root Cause
The root cause is an unbalanced cleanup path in tracepoint_add_func(). The 1 → 0 teardown logic correctly invokes unregfunc(), but the 0 → 1 registration logic does not mirror that behavior on failure. This is a state management defect, not a memory safety bug, and falls under improper error handling in kernel resource lifecycle code.
Attack Vector
Triggering the condition requires func_add() to fail. The documented failure mode is allocate_probes() returning -ENOMEM under memory pressure. A local attacker or workload that induces memory pressure while toggling syscall tracepoints can cause syscall_regfunc() to increment sys_tracepoint_refcount and set SYSCALL_TRACEPOINT on every task without a corresponding decrement.
The result is degraded system performance: every syscall on every task incurs trace entry and exit overhead for the remaining uptime of the host. Other subsystems exposing regfunc()/unregfunc() pairs exhibit analogous persistent state. The fix mirrors the 1 → 0 cleanup by calling ext->unregfunc() in the func_add() error path under the same gating condition used during teardown. See the Kernel Git Commit fad217e for the upstream resolution.
Detection Methods for CVE-2026-46196
Indicators of Compromise
- Persistent non-zero sys_tracepoint_refcount with no active tracepoint consumers registered
- SYSCALL_TRACEPOINT flag set on tasks without a corresponding tracer subscribed
- Unexplained syscall latency increase across all processes following memory pressure events
Detection Strategies
- Compare running kernel version against the patched commits 247ed8a, 2c5b8ee, 342829e, 7bcadb3, and fad217e
- Audit kernel logs for -ENOMEM failures originating from allocate_probes() or tracepoint_add_func()
- Benchmark syscall-heavy workloads before and after tracepoint registration attempts to detect persistent overhead
Monitoring Recommendations
- Track per-host syscall latency trends and flag hosts that show sustained degradation after a tracing operation
- Monitor task flags via /proc/<pid>/status and kernel debugfs for unexpected SYSCALL_TRACEPOINT markers
- Correlate memory pressure events with subsequent tracepoint registration attempts in observability pipelines
How to Mitigate CVE-2026-46196
Immediate Actions Required
- Upgrade to a Linux kernel build that includes the upstream fix referenced by commits 247ed8a, 2c5b8ee, 342829e, 7bcadb3, and fad217e
- Reboot affected hosts to clear any leaked sys_tracepoint_refcount state from prior failed registrations
- Restrict access to tracing interfaces such as tracefs and perf_event_open to privileged users only
Patch Information
The fix is published in the upstream Linux kernel stable tree. The corrective change adds an ext->unregfunc() invocation in the func_add() error path of tracepoint_add_func(), gated on the same condition used in the 1 → 0 teardown so registration and unwind are symmetric. Review the Kernel Git Commit 247ed8a, Kernel Git Commit 2c5b8ee, Kernel Git Commit 342829e, Kernel Git Commit 7bcadb3, and Kernel Git Commit fad217e for the patches across stable branches.
Workarounds
- Limit tracepoint registration operations on hosts experiencing memory pressure to reduce the probability of triggering the failure path
- Apply seccomp or capability restrictions to limit unprivileged access to tracing subsystems on multi-tenant hosts
- Reboot any host showing symptoms of leaked tracepoint state until a patched kernel is installed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
