{"id":79252,"date":"2026-06-03T21:46:29","date_gmt":"2026-06-03T18:16:29","guid":{"rendered":"https:\/\/afaghhosting.net\/blog\/cve-2026-46272-coresight-tmc-etr-fix-race-condition-between-sysfs-and-perf-mode\/"},"modified":"2026-06-03T21:46:29","modified_gmt":"2026-06-03T18:16:29","slug":"cve-2026-46272-coresight-tmc-etr-fix-race-condition-between-sysfs-and-perf-mode","status":"publish","type":"post","link":"https:\/\/afaghhosting.net\/blog\/cve-2026-46272-coresight-tmc-etr-fix-race-condition-between-sysfs-and-perf-mode\/","title":{"rendered":"CVE-2026-46272 &#8211; coresight: tmc-etr: Fix race condition between sysfs and perf mode"},"content":{"rendered":"<p>CVE ID :CVE-2026-46272<\/p>\n<p>  Published : June 3, 2026, 6:16 p.m. | 16\u00a0minutes ago<\/p>\n<p>  Description :In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>coresight: tmc-etr: Fix race condition between sysfs and perf mode<\/p>\n<p>When trying to run perf and sysfs mode simultaneously, the WARN_ON()<br \/>\nin tmc_etr_enable_hw() is triggered sometimes:<\/p>\n<p> WARNING: CPU: 42 PID: 3911571 at drivers\/hwtracing\/coresight\/coresight-tmc-etr.c:1060 tmc_etr_enable_hw+0xc0\/0xd8 [coresight_tmc]\n [..snip..]\n Call trace:<br \/>\n  tmc_etr_enable_hw+0xc0\/0xd8 [coresight_tmc] (P)<br \/>\n  tmc_enable_etr_sink+0x11c\/0x250 [coresight_tmc] (L)<br \/>\n  tmc_enable_etr_sink+0x11c\/0x250 [coresight_tmc]\n  coresight_enable_path+0x1c8\/0x218 [coresight]\n  coresight_enable_sysfs+0xa4\/0x228 [coresight]\n  enable_source_store+0x58\/0xa8 [coresight]\n  dev_attr_store+0x20\/0x40<br \/>\n  sysfs_kf_write+0x4c\/0x68<br \/>\n  kernfs_fop_write_iter+0x120\/0x1b8<br \/>\n  vfs_write+0x2c8\/0x388<br \/>\n  ksys_write+0x74\/0x108<br \/>\n  __arm64_sys_write+0x24\/0x38<br \/>\n  el0_svc_common.constprop.0+0x64\/0x148<br \/>\n  do_el0_svc+0x24\/0x38<br \/>\n  el0_svc+0x3c\/0x130<br \/>\n  el0t_64_sync_handler+0xc8\/0xd0<br \/>\n  el0t_64_sync+0x1ac\/0x1b0<br \/>\n &#8212;[ end trace 0000000000000000 ]&#8212;<\/p>\n<p>Since the enablement of sysfs mode is separeted into two critical regions,<br \/>\none for sysfs buffer allocation and another for hardware enablement, it&#8217;s<br \/>\npossible to race with the perf mode. Fix this by double check whether<br \/>\nthe perf mode&#8217;s been used before enabling the hardware in sysfs mode.<\/p>\n<p> mode:<br \/>\n   [sysfs mode]                   [perf mode]\n   tmc_etr_get_sysfs_buffer()<br \/>\n     spin_lock(&amp;drvdata-&gt;spinlock)<br \/>\n     [sysfs buffer allocation]\n     spin_unlock(&amp;drvdata-&gt;spinlock)<br \/>\n                                  spin_lock(&amp;drvdata-&gt;spinlock)<br \/>\n                                  tmc_etr_enable_hw()<br \/>\n                                    drvdata-&gt;etr_buf = etr_perf-&gt;etr_buf<br \/>\n                                  spin_unlock(&amp;drvdata-&gt;spinlock)<br \/>\n   spin_lock(&amp;drvdata-&gt;spinlock)<br \/>\n   tmc_etr_enable_hw()<br \/>\n     WARN_ON(drvdata-&gt;etr_buf) \/\/ WARN sicne etr_buf initialized at<br \/>\n                                  the perf side<br \/>\n   spin_unlock(&amp;drvdata-&gt;spinlock)<\/p>\n<p>With this fix, we retain the check for CS_MODE_PERF in get_etr_sysfs_buf.<br \/>\nThis ensures we verify whether the perf mode&#8217;s already running before we<br \/>\nactually allocate the buffer. Then we can save the time of<br \/>\nallocating\/freeing the sysfs buffer if race with the perf mode.<\/p>\n<p>  Severity: 0.0 | NA<\/p>\n<p>  Visit the link for more details, such as CVSS details, affected products, timeline, and more&#8230;\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"<p>CVE ID :CVE-2026-46272 Published : June 3, 2026, 6:16 p.m. | 16\u00a0minutes ago Description :In the Linux kernel, the following vulnerability has been resolved: coresight: tmc-etr: Fix race condition between sysfs and perf mode When trying to run perf and sysfs mode simultaneously, the WARN_ON() in tmc_etr_enable_hw() is triggered sometimes: WARNING: CPU: 42 PID: 3911571 &hellip;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-79252","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/79252","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=79252"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/79252\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=79252"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=79252"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=79252"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}