CVE-2026-46196

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func()

When a tracepoint goes through the 0 -> 1 transition, tracepoint_add_func()

invokes the subsystem's ext->regfunc() before attempting to install the

new probe via func_add(). If func_add() then fails (for example, when

allocate_probes() cannot allocate a new probe array under memory pressure

and returns -ENOMEM), the function returns the error without calling the

matching ext->unregfunc(), leaving the side effects of regfunc() behind

with no installed probe to justify them.

For syscall tracepoints this is particularly unpleasant: syscall_regfunc()

bumps sys_tracepoint_refcount and sets SYSCALL_TRACEPOINT on every task.

After a leaked failure, the refcount is stuck at a non-zero value with no

consumer, and every task continues paying the syscall trace entry/exit

overhead until reboot. Other subsystems providing regfunc()/unregfunc()

pairs exh

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References