CVE-2026-68175: tracing: Fix resource leak on mmiotrace trace_pipe close

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix resource leak on mmiotrace trace_pipe close

The mmiotrace tracer was added May 12th 2008. At that time, resources
created in pipe_open() could not be freed because there was not
pipe_close function pointer of the tracer. The pipe_close function pointer
was added in December 7th, 2009, but the mmiotrace tracer was not updated.

mmio_pipe_open() allocates a header_iter and takes a pci_dev reference
when trace_pipe is opened. mmio_close() frees them, but it was only
wired to the tracer's .close callback.

tracing_release_pipe() invokes .pipe_close, not .close, when the
trace_pipe file is released. As a result, closing trace_pipe with the
mmiotrace tracer active leaked the header_iter allocation and left a
stale pci_dev reference.

Set .pipe_close to mmio_close, matching how function_graph wires both
callbacks to the same handler.

Note, if the trace_pipe is read to completion, it will clean up the
resources, but if one were to run:

  # head -n 1 /sys/kernel/tracing/trace_pipe
 VERSION 20070824

Over and over again, it would trigger a massive leak.

The Linux kernel CVE team has assigned CVE-2026-68175 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 2.6.33 with commit c521efd1700a8c0f7ce26f011f5eaecca17fabfa and fixed in 6.6.148 with commit f9e6dfe341fb31c95b9655eb6b1db8b3ae090817
	Issue introduced in 2.6.33 with commit c521efd1700a8c0f7ce26f011f5eaecca17fabfa and fixed in 6.12.101 with commit 594e1cf3f736779a535873fd5988162d827bfe4f
	Issue introduced in 2.6.33 with commit c521efd1700a8c0f7ce26f011f5eaecca17fabfa and fixed in 6.18.42 with commit cf5a82bef623b969a609f2b7e392d06dbae34aa6
	Issue introduced in 2.6.33 with commit c521efd1700a8c0f7ce26f011f5eaecca17fabfa and fixed in 7.1.6 with commit cb459fec4f7b13caf646101ff076e94ef38434d8
	Issue introduced in 2.6.33 with commit c521efd1700a8c0f7ce26f011f5eaecca17fabfa and fixed in 7.2-rc5 with commit c1d87e724ae55e781b7cc7ccafb34d9e668582b2

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-68175
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	kernel/trace/trace_mmiotrace.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/f9e6dfe341fb31c95b9655eb6b1db8b3ae090817
	https://git.kernel.org/stable/c/594e1cf3f736779a535873fd5988162d827bfe4f
	https://git.kernel.org/stable/c/cf5a82bef623b969a609f2b7e392d06dbae34aa6
	https://git.kernel.org/stable/c/cb459fec4f7b13caf646101ff076e94ef38434d8
	https://git.kernel.org/stable/c/c1d87e724ae55e781b7cc7ccafb34d9e668582b2