CVE-2026-90273

What it actually does

Missing calls to cscfg_csdev_disable_active_config() in error paths of the perf enable sequence for etm4x devices (unsupported branch broadcast or etm4_enable_hw failure) cause a reference count leak on config_desc->active_cnt.

Why it matters to the business

Repeated triggering of affected error paths during performance tracing can slowly exhaust kernel resources or leave the tracing subsystem in an inconsistent state, potentially affecting debug and monitoring capabilities on systems using coresight etm4x hardware.

How an attack unfolds

An attacker with local access enables perf tracing with branch broadcast configuration on unsupported hardware or forces etm4_enable_hw failure; the missing cleanup leaves the active count incremented, resulting in a leak rather than direct code execution or privilege escalation.

How to fix it

Apply the upstream patch that adds the missing cscfg_csdev_disable_active_config() calls in the identified error paths; rebuild and deploy the updated kernel on affected systems.

How to confirm the fix worked

Inspect the etm4x perf enable code paths in the updated kernel source to confirm the disable calls are present in both error branches; test perf enable with branch broadcast on unsupported hardware and verify no active_cnt leak occurs via tracing counters or memory analysis.

Typical attack path

1. Obtain local access on a system with coresight etm4x hardware
2. Configure perf events using branch broadcast or other settings that hit unsupported paths
3. Trigger etm4_enable_hw failure or unsupported configuration in the enable path
4. Observe gradual accumulation of leaked active_cnt references

How to detect it

Search kernel logs and perf tracing output for repeated etm4x enable failures or branch broadcast configuration attempts; examine coresight subsystem state counters for unexpected active reference growth after perf sessions.

What your security team should do

• Prioritize kernel updates on systems using coresight etm4x and perf tracing within normal patching cycles
• Review internal workloads that rely on perf branch tracing for exposure frequency
• Monitor kernel logs for coresight and etm4x related warnings after deployment