The vulnerability resides in the Linux kernel’s tracing subsystem. When the mmiotrace tracer is active, opening /sys/kernel/tracing/trace_pipe allocates a header iterator and holds a reference to a PCI device, but the tracer’s close callback does not release these resources. The kernel’s pipe release logic mistakenly calls the tracer’s .pipe_close method instead of .close, leaving unmanaged allocations and stale references. Repeatedly reading the trace_pipe without fully consuming it causes a growing leak that can exhaust system memory and destabilize the kernel. The weakness is a missing release of heap memory, matching CWE-772. The impact is a local denial‑of‑service condition where an attacker can trigger a memory exhaustion by repeatedly accessing the trace pipe. Access to the tracing interface typically requires elevated privileges, so the threat is limited to privileged or compromised users.

Linux kernel installations that enable the mmiotrace tracer are affected. No specific kernel version range is documented, but the patch was committed in early 2026, indicating that current kernel releases prior to that commit are vulnerable. All distributions shipping the Linux kernel prior to the patch are at risk.

The risk is moderate to high due to the potential for a denial‑of‑service if the vulnerable process can repeatedly open and read the trace_pipe. The exploitability requires ability to access the tracing interface, which usually needs root or kernel‑tracing privileges, so the attack vector is local privileged. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the documented massive leak suggests it could be actively exploited in environments with unrestricted tracing access.