CVE-2026-72309 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
tracing/remotes: Fix leak in trace_remote_alloc_buffer() error path
If page allocation fails in trace_remote_alloc_buffer(), desc->nr_cpus is not yet incremented for the current CPU. As a consequence, on error, half-allocated rb_desc will not be freed in trace_remote_free_buffer().
Increment desc->nr_cpus as soon as the first allocation for the current CPU has succeeded.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability resides in the Linux kernel's tracing subsystem, specifically within the remote tracing functionality that manages buffer allocations for distributed tracing operations. The issue manifests as a memory leak occurring during error handling pathways when the kernel attempts to allocate pages for remote trace buffers. The flaw exists in the trace_remote_alloc_buffer() function where proper resource management fails during allocation failure scenarios, creating a partial allocation state that leaves memory resources stranded in the system.
The technical root cause stems from improper ordering of operations within the buffer allocation logic. When page allocation fails during the trace_remote_alloc_buffer() execution, the code path does not properly account for partially allocated resources because desc->nr_cpus remains unincremented for the current CPU. This creates a scenario where half-allocated rb_desc structures are left in an inconsistent state, preventing the trace_remote_free_buffer() function from correctly identifying and releasing all allocated memory components. The vulnerability represents a classic resource leak pattern where allocation failures result in memory not being properly cleaned up, leading to gradual memory consumption degradation.
The operational impact of this vulnerability extends beyond simple memory waste to potentially compromise system stability and performance under sustained tracing operations. Attackers could exploit this weakness to cause progressive memory exhaustion through repeated triggering of the error path, especially in environments with intensive tracing workloads or where remote tracing is frequently enabled. The leak accumulates over time as failed allocations leave behind partially allocated buffer structures that remain unreclaimed, eventually leading to system performance degradation or even out-of-memory conditions that could affect other critical kernel operations.
Mitigation strategies should focus on implementing proper resource management within the allocation error handling paths by ensuring that desc->nr_cpus is incremented immediately upon successful allocation of the first CPU's resources. This approach aligns with established security practices around resource acquisition and release in kernel code, following the principle of immediate state synchronization during allocation operations. The fix requires careful attention to the order of operations within trace_remote_alloc_buffer() to ensure proper tracking of allocated resources regardless of subsequent allocation failures, thereby preventing the orphaned memory states that lead to the leak condition.
This vulnerability maps to CWE-401: Improper Handling of Exceptional Conditions and relates to ATT&CK technique T1070.004: Indicator Removal on Host through improper resource management in kernel space. The issue demonstrates how seemingly minor ordering problems in kernel memory allocation can result in significant security implications, particularly when considering that the Linux kernel operates with elevated privileges and system-wide impact. Proper implementation of this fix requires adherence to kernel development best practices for memory management and error handling, ensuring that all allocated resources are properly tracked and released during both successful and failed execution paths to prevent resource leakage vulnerabilities.