CVE-2026-68175: Linux Kernel mmiotrace DoS Vulnerability

CVE-2026-68175 Overview

CVE-2026-68175 is a resource leak vulnerability in the Linux kernel's tracing subsystem. The flaw resides in the mmiotrace tracer, which was added in May 2008. The tracer's mmio_pipe_open() function allocates a header_iter and takes a pci_dev reference when trace_pipe is opened. The corresponding mmio_close() function that frees these resources was wired only to the tracer's .close callback, not .pipe_close. Since tracing_release_pipe() invokes .pipe_close when the trace_pipe file is released, closing trace_pipe with the mmiotrace tracer active leaks the header_iter allocation and leaves a stale pci_dev reference.

Critical Impact
Repeated open and close operations on /sys/kernel/tracing/trace_pipe while the mmiotrace tracer is active can trigger sustained kernel memory leaks and stale device references.

Affected Products

Linux kernel with mmiotrace tracer enabled (CONFIG_MMIOTRACE)
Kernel versions from the introduction of .pipe_close callback (December 2009) through the fix
Systems exposing /sys/kernel/tracing/trace_pipe to privileged users

Discovery Timeline

2026-08-10 - CVE-2026-68175 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68175

Vulnerability Analysis

The mmiotrace tracer records memory-mapped I/O accesses for debugging PCI device drivers. When a user opens /sys/kernel/tracing/trace_pipe, the kernel invokes mmio_pipe_open(), which allocates a header_iter structure and increments the reference count on an associated pci_dev. The intended cleanup function mmio_close() releases both resources.

The tracer registration wired mmio_close() only to the .close callback. The tracing core, however, calls .pipe_close when releasing the trace_pipe file descriptor via tracing_release_pipe(). The mismatch means mmio_close() never runs on normal file close, so allocations persist across every open and close cycle.

The leak is bounded per open only if the reader consumes the pipe to completion, which triggers an alternate cleanup path. Short reads followed by close skip that path entirely.

Root Cause

The root cause is a missing callback registration in the mmiotrace tracer definition. The .pipe_close function pointer was introduced on December 7, 2009, but the mmiotrace tracer, added in May 2008, was never updated to set it. The fix sets .pipe_close to mmio_close, matching how function_graph wires both callbacks to the same handler.

Attack Vector

A local user with permission to read /sys/kernel/tracing/trace_pipe can trigger the leak by repeatedly opening the file and closing it before reading to completion. Running a command such as head -n 1 /sys/kernel/tracing/trace_pipe in a loop with the mmiotrace tracer active leaks a header_iter allocation and holds a stale pci_dev reference on each iteration. Access to tracefs is typically restricted to root, limiting the vector to privileged local users. The vulnerability manifests as memory pressure and device reference count anomalies rather than direct code execution.

See the upstream fix in the Linux Kernel Commit for the technical resolution.

Detection Methods for CVE-2026-68175

Indicators of Compromise

Growing kernel slab usage attributable to header_iter allocations without a matching increase in tracer usage
Elevated pci_dev reference counts on devices under mmiotrace observation
Repeated short-read access patterns to /sys/kernel/tracing/trace_pipe while current_tracer is set to mmiotrace

Detection Strategies

Audit tracefs access with auditd rules on /sys/kernel/tracing/trace_pipe and /sys/kernel/tracing/current_tracer
Monitor /proc/slabinfo for unexpected growth in kernel object allocations correlating with tracer activity
Correlate process telemetry to identify unprivileged looping reads against tracefs paths

Monitoring Recommendations

Alert on writes to /sys/kernel/tracing/current_tracer setting the value to mmiotrace on production systems
Track kernel memory growth over time and flag sustained upward trends without workload justification
Log root-shell activity that opens tracing interfaces outside of scheduled maintenance windows

How to Mitigate CVE-2026-68175

Immediate Actions Required

Apply the upstream kernel patch that wires .pipe_close to mmio_close in the mmiotrace tracer
Restrict access to /sys/kernel/tracing/ to trusted administrators via filesystem permissions and namespace controls
Disable the mmiotrace tracer on production systems that do not require MMIO debugging

Patch Information

The fix has been committed to the stable Linux kernel tree across multiple branches. Reference the following upstream commits:

Workarounds

Set current_tracer back to nop when mmiotrace debugging is not actively in use
Ensure any consumer of trace_pipe reads the stream to EOF before closing, which triggers the alternate cleanup path
Reduce kernel attack surface by building kernels without CONFIG_MMIOTRACE where the feature is not required

bash

# Disable mmiotrace tracer at runtime
echo nop > /sys/kernel/tracing/current_tracer

# Restrict tracefs access to root only
mount -o remount,mode=0700 /sys/kernel/tracing