CVE-2026-80623: Linux Kernel Coresight ETE Privilege Escalation

CVE-2026-80623 Overview

CVE-2026-80623 affects the Linux kernel's Coresight Embedded Trace Extension (ETE) driver. The flaw stems from the driver failing to save trace state before CPU power down events. System register ETMs and ETE registers are not preserved across CPU power state transitions, and the ETE Device Tree binding never documented arm,coresight-loses-context-with-cpu. ACPI provides no equivalent binding at all.

The result is that Coresight trace state can be lost or corrupted after CPU power management events, producing warnings such as coresight ete0: External agent took claim tag on hardware platforms with CPU power management, including the Arm Fixed Virtual Platform (FVP).

Critical Impact
Trace subsystem state corruption and driver warnings on Arm systems using Coresight ETE with ACPI or system-register ETMs during CPU power transitions.

Affected Products

Linux kernel Coresight ETE driver (drivers/hwtracing/coresight/)
Arm platforms exposing system-register ETMs or ETE via ACPI
Arm Fixed Virtual Platform (FVP) configurations with CPU power management enabled

Discovery Timeline

2026-08-28 - CVE-2026-80623 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-80623

Vulnerability Analysis

The issue lives in the Coresight ETE driver's handling of CPU power management (CPU PM) events. When a CPU powers down, system-register based trace units lose their configuration state. The driver relied on the Device Tree property arm,coresight-loses-context-with-cpu to decide whether to save state, but this property was never documented for ETE and does not exist under ACPI.

Without save/restore logic engaging, the driver assumed hardware state persisted across power transitions. On resume, the trace unit reported that an external agent had taken its claim tag, and the kernel emitted a WARNING from coresight_disclaim_device_unlocked() in drivers/hwtracing/coresight/coresight-core.c:248. This surfaces as a functional defect for perf users tracing across idle transitions.

The fix hard-codes save-on-power-down behavior for system-register ETMs (which includes all ETE devices) and for ACPI-booted systems. It also switches the code to use a local variable when populating save_state, preventing race conditions when devices with differing configurations probe concurrently against the previously shared global.

Root Cause

The driver combined two flaws. First, it gated context save/restore on a binding property that ETE and ACPI never supported, so the correct behavior was unreachable. Second, save_state setup mutated a global structure, creating a concurrency hazard during parallel device probing.

Attack Vector

This is a reliability and state-integrity defect rather than a directly exploitable memory-safety issue. No CWE has been assigned and no exploit is known. Impact is limited to trace correctness, kernel warnings, and potential downstream side effects for tools consuming Coresight data such as perf.

The vulnerability manifests during normal CPU idle or hotplug operations on affected Arm systems. See the upstream commits for the technical fix details.

Detection Methods for CVE-2026-80623

Indicators of Compromise

Kernel log entries containing coresight ete0: External agent took claim tag
WARNING traces originating in coresight_disclaim_device_unlocked at drivers/hwtracing/coresight/coresight-core.c:248
perf sessions using Coresight that fail or produce truncated trace data after CPU idle events

Detection Strategies

Inventory Arm-based Linux hosts running Coresight-enabled kernels booted via ACPI or using system-register ETMs
Correlate kernel WARNING events with CPU power management transitions using centralized log analysis
Compare running kernel versions against the patched commits 293dacd, 2ab4645, and 65d87f2 on kernel.org

Monitoring Recommendations

Forward dmesg and journald kernel messages to a centralized log store and alert on Coresight warnings
Track Coresight driver load and probe events on fleets that rely on kernel tracing for performance or forensics workflows
Validate that perf trace collection completes successfully after suspend, resume, and CPU hotplug cycles

How to Mitigate CVE-2026-80623

Immediate Actions Required

Apply the upstream Coresight ETE patches referenced by commits 293dacd5b6a9, 2ab4645fe420, and 65d87f28daec
Rebuild and deploy kernels for affected Arm platforms, prioritizing hosts that boot via ACPI with CPU PM enabled
Restart or retest any tracing pipelines that consume Coresight data after patch deployment

Patch Information

The fix is available in the mainline and stable Linux kernel trees. Refer to the Kernel Git Commit 293dacd, Kernel Git Commit 2ab4645, and Kernel Git Commit 65d87f2 for the exact code changes.

Workarounds

Disable Coresight ETE tracing on affected hosts until the patched kernel is deployed
Avoid running perf sessions that traverse CPU idle or hotplug transitions when using Coresight
Where feasible, disable CPU power management during trace collection to prevent the driver from encountering the unhandled power-down path