CVE-2026-46272

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-46272", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-13T15:03:33.109Z", "datePublished": "2026-06-03T15:50:14.618Z", "dateUpdated": "2026-10-21T12:41:33.089Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:41:33.089Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncoresight: tmc-etr: Fix race condition between sysfs and perf mode\n\nWhen trying to run perf and sysfs mode simultaneously, the WARN_ON()\nin tmc_etr_enable_hw() is triggered sometimes:\n\n WARNING: CPU: 42 PID: 3911571 at drivers/hwtracing/coresight/coresight-tmc-etr.c:1060 tmc_etr_enable_hw+0xc0/0xd8 [coresight_tmc]\n [..snip..]\n Call trace:\n tmc_etr_enable_hw+0xc0/0xd8 [coresight_tmc] (P)\n tmc_enable_etr_sink+0x11c/0x250 [coresight_tmc] (L)\n tmc_enable_etr_sink+0x11c/0x250 [coresight_tmc]\n coresight_enable_path+0x1c8/0x218 [coresight]\n coresight_enable_sysfs+0xa4/0x228 [coresight]\n enable_source_store+0x58/0xa8 [coresight]\n dev_attr_store+0x20/0x40\n sysfs_kf_write+0x4c/0x68\n kernfs_fop_write_iter+0x120/0x1b8\n vfs_write+0x2c8/0x388\n ksys_write+0x74/0x108\n __arm64_sys_write+0x24/0x38\n el0_svc_common.constprop.0+0x64/0x148\n do_el0_svc+0x24/0x38\n el0_svc+0x3c/0x130\n el0t_64_sync_handler+0xc8/0xd0\n el0t_64_sync+0x1ac/0x1b0\n ---[ end trace 0000000000000000 ]---\n\nSince the enablement of sysfs mode is separeted into two critical regions,\none for sysfs buffer allocation and another for hardware enablement, it's\npossible to race with the perf mode. Fix this by double check whether\nthe perf mode's been used before enabling the hardware in sysfs mode.\n\n mode:\n [sysfs mode] [perf mode]\n tmc_etr_get_sysfs_buffer()\n spin_lock(&drvdata->spinlock)\n [sysfs buffer allocation]\n spin_unlock(&drvdata->spinlock)\n spin_lock(&drvdata->spinlock)\n tmc_etr_enable_hw()\n drvdata->etr_buf = etr_perf->etr_buf\n spin_unlock(&drvdata->spinlock)\n spin_lock(&drvdata->spinlock)\n tmc_etr_enable_hw()\n WARN_ON(drvdata->etr_buf) // WARN sicne etr_buf initialized at\n the perf side\n spin_unlock(&drvdata->spinlock)\n\nWith this fix, we retain the check for CS_MODE_PERF in get_etr_sysfs_buf.\nThis ensures we verify whether the perf mode's already running before we\nactually allocate the buffer. Then we can save the time of\nallocating/freeing the sysfs buffer if race with the perf mode."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/hwtracing/coresight/coresight-tmc-etr.c"], "versions": [{"version": "296b01fd106e787d4463974a7f42d286a5df08cd", "lessThan": "3e8cdf184646c28c5ea5fba754d24a3b29068739", "status": "affected", "versionType": "git"}, {"version": "296b01fd106e787d4463974a7f42d286a5df08cd", "lessThan": "206b6f672613d08b33e951a744d0a1c6ac5ad8ad", "status": "affected", "versionType": "git"}, {"version": "296b01fd106e787d4463974a7f42d286a5df08cd", "lessThan": "38a07194bbcddb18d77dad40ba9978d994c0b74c", "status": "affected", "versionType": "git"}, {"version": "296b01fd106e787d4463974a7f42d286a5df08cd", "lessThan": "6906aa70d4fc5900b954136e20e27c2be6d1acab", "status": "affected", "versionType": "git"}, {"version": "296b01fd106e787d4463974a7f42d286a5df08cd", "lessThan": "e6e43e82c79c97917cbe356c07e8a6f3f982ab53", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/hwtracing/coresight/coresight-tmc-etr.c"], "versions": [{"version": "6.5", "status": "affected"}, {"version": "0", "lessThan": "6.5", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.114", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.14", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.4", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.12.114"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.18.14"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.19.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3e8cdf184646c28c5ea5fba754d24a3b29068739"}, {"url": "https://git.kernel.org/stable/c/206b6f672613d08b33e951a744d0a1c6ac5ad8ad"}, {"url": "https://git.kernel.org/stable/c/38a07194bbcddb18d77dad40ba9978d994c0b74c"}, {"url": "https://git.kernel.org/stable/c/6906aa70d4fc5900b954136e20e27c2be6d1acab"}, {"url": "https://git.kernel.org/stable/c/e6e43e82c79c97917cbe356c07e8a6f3f982ab53"}], "title": "coresight: tmc-etr: Fix race condition between sysfs and perf mode", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/hwtracing/coresight/coresight-tmc-etr.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3e8cdf184646c28c5ea5fba754d24a3b29068739", "status": "affected", "version": "296b01fd106e787d4463974a7f42d286a5df08cd", "versionType": "git"}, {"lessThan": "206b6f672613d08b33e951a744d0a1c6ac5ad8ad", "status": "affected", "version": "296b01fd106e787d4463974a7f42d286a5df08cd", "versionType": "git"}, {"lessThan": "38a07194bbcddb18d77dad40ba9978d994c0b74c", "status": "affected", "version": "296b01fd106e787d4463974a7f42d286a5df08cd", "versionType": "git"}, {"lessThan": "6906aa70d4fc5900b954136e20e27c2be6d1acab", "status": "affected", "version": "296b01fd106e787d4463974a7f42d286a5df08cd", "versionType": "git"}, {"lessThan": "e6e43e82c79c97917cbe356c07e8a6f3f982ab53", "status": "affected", "version": "296b01fd106e787d4463974a7f42d286a5df08cd", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/hwtracing/coresight/coresight-tmc-etr.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.5"}, {"lessThan": "6.5", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.114", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.14", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9F546B77-5B07-4E1F-838D-065C9F6E31E5", "versionEndExcluding": "6.18.14", "versionStartIncluding": "6.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "672A3E79-EC03-479D-8503-361DFBDC8092", "versionEndExcluding": "6.19.4", "versionStartIncluding": "6.19", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncoresight: tmc-etr: Fix race condition between sysfs and perf mode\n\nWhen trying to run perf and sysfs mode simultaneously, the WARN_ON()\nin tmc_etr_enable_hw() is triggered sometimes:\n\n WARNING: CPU: 42 PID: 3911571 at drivers/hwtracing/coresight/coresight-tmc-etr.c:1060 tmc_etr_enable_hw+0xc0/0xd8 [coresight_tmc]\n [..snip..]\n Call trace:\n tmc_etr_enable_hw+0xc0/0xd8 [coresight_tmc] (P)\n tmc_enable_etr_sink+0x11c/0x250 [coresight_tmc] (L)\n tmc_enable_etr_sink+0x11c/0x250 [coresight_tmc]\n coresight_enable_path+0x1c8/0x218 [coresight]\n coresight_enable_sysfs+0xa4/0x228 [coresight]\n enable_source_store+0x58/0xa8 [coresight]\n dev_attr_store+0x20/0x40\n sysfs_kf_write+0x4c/0x68\n kernfs_fop_write_iter+0x120/0x1b8\n vfs_write+0x2c8/0x388\n ksys_write+0x74/0x108\n __arm64_sys_write+0x24/0x38\n el0_svc_common.constprop.0+0x64/0x148\n do_el0_svc+0x24/0x38\n el0_svc+0x3c/0x130\n el0t_64_sync_handler+0xc8/0xd0\n el0t_64_sync+0x1ac/0x1b0\n ---[ end trace 0000000000000000 ]---\n\nSince the enablement of sysfs mode is separeted into two critical regions,\none for sysfs buffer allocation and another for hardware enablement, it's\npossible to race with the perf mode. Fix this by double check whether\nthe perf mode's been used before enabling the hardware in sysfs mode.\n\n mode:\n [sysfs mode] [perf mode]\n tmc_etr_get_sysfs_buffer()\n spin_lock(&drvdata->spinlock)\n [sysfs buffer allocation]\n spin_unlock(&drvdata->spinlock)\n spin_lock(&drvdata->spinlock)\n tmc_etr_enable_hw()\n drvdata->etr_buf = etr_perf->etr_buf\n spin_unlock(&drvdata->spinlock)\n spin_lock(&drvdata->spinlock)\n tmc_etr_enable_hw()\n WARN_ON(drvdata->etr_buf) // WARN sicne etr_buf initialized at\n the perf side\n spin_unlock(&drvdata->spinlock)\n\nWith this fix, we retain the check for CS_MODE_PERF in get_etr_sysfs_buf.\nThis ensures we verify whether the perf mode's already running before we\nactually allocate the buffer. Then we can save the time of\nallocating/freeing the sysfs buffer if race with the perf mode."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ncoresight: tmc-etr: Soluciona condici\u00f3n de carrera entre el modo sysfs y perf\n\nAl intentar ejecutar los modos perf y sysfs simult\u00e1neamente, el WARN_ON() en tmc_etr_enable_hw() se activa a veces:\n\n ADVERTENCIA: CPU: 42 PID: 3911571 en drivers/hwtracing/coresight/coresight-tmc-etr.c:1060 tmc_etr_enable_hw+0xc0/0xd8 [coresight_tmc]\n [..recorte..]\n Rastro de llamada:\n tmc_etr_enable_hw+0xc0/0xd8 [coresight_tmc] (P)\n tmc_enable_etr_sink+0x11c/0x250 [coresight_tmc] (L)\n tmc_enable_etr_sink+0x11c/0x250 [coresight_tmc]\n coresight_enable_path+0x1c8/0x218 [coresight]\n coresight_enable_sysfs+0xa4/0x228 [coresight]\n enable_source_store+0x58/0xa8 [coresight]\n dev_attr_store+0x20/0x40\n sysfs_kf_write+0x4c/0x68\n kernfs_fop_write_iter+0x120/0x1b8\n vfs_write+0x2c8/0x388\n ksys_write+0x74/0x108\n __arm64_sys_write+0x24/0x38\n el0_svc_common.constprop.0+0x64/0x148\n do_el0_svc+0x24/0x38\n el0_svc+0x3c/0x130\n el0t_64_sync_handler+0xc8/0xd0\n el0t_64_sync+0x1ac/0x1b0\n ---[ fin del rastro 0000000000000000 ]---\n\nDado que la habilitaci\u00f3n del modo sysfs est\u00e1 separada en dos regiones cr\u00edticas, una para la asignaci\u00f3n del b\u00fafer sysfs y otra para la habilitaci\u00f3n del hardware, es posible que haya una condici\u00f3n de carrera con el modo perf. Soluciona esto verificando dos veces si el modo perf ha sido utilizado antes de habilitar el hardware en el modo sysfs.\n\n modo:\n [modo sysfs] [modo perf]\n tmc_etr_get_sysfs_buffer()\n spin_lock(&drvdata->spinlock)\n [asignaci\u00f3n de b\u00fafer sysfs]\n spin_unlock(&drvdata->spinlock)\n spin_lock(&drvdata->spinlock)\n tmc_etr_enable_hw()\n drvdata->etr_buf = etr_perf->etr_buf\n spin_unlock(&drvdata->spinlock)\n spin_lock(&drvdata->spinlock)\n tmc_etr_enable_hw()\n WARN_ON(drvdata->etr_buf) // ADVERTENCIA ya que etr_buf inicializado en\n el lado perf\n spin_unlock(&drvdata->spinlock)\n\nCon esta soluci\u00f3n, mantenemos la verificaci\u00f3n de CS_MODE_PERF en get_etr_sysfs_buf. Esto asegura que verifiquemos si el modo perf ya est\u00e1 en ejecuci\u00f3n antes de asignar realmente el b\u00fafer. Entonces podemos ahorrar el tiempo de asignar/liberar el b\u00fafer sysfs si hay una condici\u00f3n de carrera con el modo perf."}], "id": "CVE-2026-46272", "lastModified": "2026-10-21T13:19:06.063", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-06-03T18:16:29.023", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/206b6f672613d08b33e951a744d0a1c6ac5ad8ad"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/38a07194bbcddb18d77dad40ba9978d994c0b74c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3e8cdf184646c28c5ea5fba754d24a3b29068739"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6906aa70d4fc5900b954136e20e27c2be6d1acab"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e6e43e82c79c97917cbe356c07e8a6f3f982ab53"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: coresight: tmc-etr: Fix race condition between sysfs and perf mode", "id": "2484482", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484482"}, "csaw": false, "cwe": "CWE-367", "details": ["A flaw was found in the Linux kernel's Coresight Trace Memory Controller (TMC) Embedded Trace Router (ETR) driver. A race condition can occur when both the sysfs and perf modes are used simultaneously. This can lead to a kernel warning, potentially causing system instability or unexpected behavior."], "name": "CVE-2026-46272", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-06-03T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-46272\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-46272\nhttps://lore.kernel.org/linux-cve-announce/2026060339-CVE-2026-46272-7a48@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[296b01fd106e787d4463974a7f42d286a5df08cd,38a07194bbcddb18d77dad40ba9978d994c0b74c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[296b01fd106e787d4463974a7f42d286a5df08cd,6906aa70d4fc5900b954136e20e27c2be6d1acab)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[296b01fd106e787d4463974a7f42d286a5df08cd,e6e43e82c79c97917cbe356c07e8a6f3f982ab53)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.5"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.5)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.14,6.19.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.4,6.20.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-06-03T19:45:41.337895+00:00", "updated": "2026-06-09T23:45:15.689360+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}