CVE-2026-46272: Linux CoreSight TMC-ETR Race Condition DoS

Technical summary

The vulnerability resides in drivers/hwtracing/coresight/coresight-tmc-etr.c at the tmc_etr_enable_hw() function. The issue stems from a classic check-then-act race condition where sysfs mode first allocates a buffer under spinlock protection via tmc_etr_get_sysfs_buffer(), releases the lock, and later reacquires it to call tmc_etr_enable_hw(). During this window, perf mode can acquire the spinlock, initialize the device's etr_buf pointer to its own buffer, and release the lock. When sysfs mode subsequently calls tmc_etr_enable_hw(), the function's WARN_ON(drvdata->etr_buf) check fails because the buffer is already initialized—not by sysfs, but by perf. The fix implements a double-check pattern in sysfs mode's get_etr_sysfs_buf function to verify perf mode is not already running before proceeding with buffer allocation, eliminating the race window entirely.

Business impact

This vulnerability causes kernel warnings and denial of service conditions in systems that use CoreSight hardware tracing—primarily found in ARM-based servers, embedded systems, and SoCs with advanced debugging capabilities. The impact is moderate because triggering the condition requires simultaneous mixed usage of tracing modes (perf and sysfs) via local privileged access. However, on systems where both interfaces are active or monitored, it can lead to unpredictable kernel behavior, system instability, or crashes during troubleshooting and performance analysis workflows. Organizations relying on continuous hardware-level tracing for debugging or profiling may experience service interruptions.

Affected systems

The vulnerability affects the Linux kernel's CoreSight TMC-ETR driver, which is used on ARM-based platforms with hardware tracing capabilities. This includes ARM servers (Ampere Altra, Graviton, Neoverse-based), Qualcomm Snapdragon platforms, and various embedded systems with CoreSight support. The vulnerability is triggered only when both perf tracing and sysfs hardware tracing interfaces are actively managed, requiring local system access and elevated privileges. Non-ARM systems or systems not using CoreSight hardware tracing are unaffected.

Exploitability

Exploitability is limited by multiple factors: the attack vector is local-only, privileged user or developer access is required to write to sysfs tracing interfaces and invoke perf commands, and the race condition itself requires precise timing to manifest. The WARN_ON() trigger is probabilistic rather than deterministic, depending on CPU scheduling and system load. While a privileged attacker could intentionally trigger this by rapidly alternating perf and sysfs tracing operations, the primary risk is accidental concurrent usage by system administrators or developers. This is classified as a denial of service vulnerability rather than a confidentiality or integrity threat.

Remediation

Apply the kernel patch that implements double-check verification in the sysfs buffer allocation path. The fix ensures tmc_etr_enable_hw() verifies perf mode is not already active before attempting sysfs enablement, closing the race window. After patching, the driver gracefully avoids buffer allocation when perf mode is detected, preventing the WARN_ON() condition entirely. Verify the patch is present in your kernel version or compile a kernel with the fix applied. No workarounds are available for unpatched systems other than avoiding simultaneous use of perf and sysfs tracing interfaces.

Patch guidance

Identify your Linux kernel version and verify the patch has been integrated. Check the CoreSight TMC driver source (coresight-tmc-etr.c) for the double-check logic in tmc_etr_get_sysfs_buffer() that validates perf mode before proceeding. If running a distribution kernel, check your vendor's security advisory for the specific kernel package version containing this fix. For upstream kernels, the fix is present in the mainline commit that resolves this race condition. Test patched systems by attempting concurrent perf and sysfs tracing to confirm the WARN_ON() no longer triggers. Document your kernel baseline version and patch date for compliance tracking.

Detection guidance

Monitor kernel logs for WARN_ON() messages originating from tmc_etr_enable_hw() at drivers/hwtracing/coresight/coresight-tmc-etr.c:1060. Systems exhibiting this warning are running vulnerable code and attempting concurrent perf and sysfs tracing. Check system audit logs for simultaneous writes to sysfs CoreSight trace control files combined with active perf tracing sessions. On affected platforms, enable CoreSight driver debug logging to capture race condition indicators. While no CVE-specific attack signatures exist, observing this kernel warning is a strong indicator of either accidental misconfiguration or deliberate stress-testing of tracing interfaces.

Why prioritize this

Although classified as MEDIUM severity (CVSS 4.7) due to local-only attack vector, elevated privilege requirement, and denial-of-service impact, this vulnerability should be prioritized for patching on any ARM-based infrastructure where CoreSight hardware tracing is actively used for production debugging, performance analysis, or telemetry collection. The fix is straightforward and low-risk, making remediation a high-value defensive measure. Systems where tracing is not actively used face minimal practical risk and can defer patching to routine maintenance windows.

Risk score, explained

The CVSS 4.7 MEDIUM score reflects the vulnerability's local attack vector (AV:L), high attack complexity due to race condition timing requirements (AC:H), low privilege requirement (PR:L—any local user can write to sysfs), no user interaction needed (UI:N), unchanged scope (S:U), and unavailability impact only (A:H with no C:N or I:N). The high complexity factor appropriately discounts the exploitability because reliably triggering the race requires specific timing and system state. The score appropriately prioritizes the availability impact without inflating risk for confidentiality or integrity concerns.

Frequently asked questions