The kernel’s tracing subsystem can leak memory when the mmiotrace tracer is active. Opening the trace_pipe file allocates a header iterator and holds a reference to a PCI device, but the tracer’s close callback is not wired to release these resources. As a result, repeatedly reading the trace_pipe without draining it completely causes a growing leak of heap memory and stale device references, matching the CWE-763 improper resource cleanup weakness. The leak can exhaust system memory and destabilize the kernel if repeated actions are performed.

All Linux kernels that include the mmiotrace tracer but have not yet applied the patch that wires mmio_close to the tracer’s .pipe_close callback are affected. This includes canonical Linux distributions whose kernel releases predate the commit that fixed the issue. Enabling the tracer via the /sys/kernel/tracing/tracer setting or accessing the /sys/kernel/tracing/trace_pipe interface without the patch will expose the vulnerability.

The CVSS score of 4.4 indicates a medium severity for a local resource leak. The EPSS score is <1%, showing a very low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is local privileged, requiring either root or kernel‑tracing privileges to repeatedly open and read the trace_pipe and trigger the leak. An attacker with such access could cause a denial‑of‑service by exhausting system memory through continuous reads.