CVE-2026-46196

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func()

When a tracepoint goes through the 0 -> 1 transition, tracepoint_add_func()

invokes the subsystem's ext->regfunc() before attempting to install the

new probe via func_add(). If func_add() then fails (for example, when

allocate_probes() cannot allocate a new probe array under memory pressure

and returns -ENOMEM), the function returns the error without calling the

matching ext->unregfunc(), leaving the side effects of regfunc() behind

with no installed probe to justify them.

For syscall tracepoints this is particularly unpleasant: syscall_regfunc()

bumps sys_tracepoint_refcount and sets SYSCALL_TRACEPOINT on every task.

After a leaked failure, the refcount is stuck at a non-zero value with no

consumer, and every task continues paying the syscall trace entry/exit

overhead until reboot. Other subsystems providing regfunc()/unregfunc()

pairs exh

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References