CVE-2026-80623
Description
A flaw was found in the Coresight Embedded Trace Extension (ETE) component of the Linux kernel. This vulnerability arises because the system register states for Embedded Trace Macrocells (ETMs) and ETE are not consistently preserved when the CPU powers down. A local attacker could potentially trigger this condition by interacting with CPU power management, which may lead to system instability or a denial of service due to improper state handling and resource management.
Statement
A flaw of moderate severity was found in the Linux kernel's Coresight Embedded Trace Extension (ETE) support. The configuration and state of system-register ETMs and ETE are not preserved when a CPU powers down, because the ETE device-tree binding never documented a context-loss property and ACPI boots have no such mechanism at all. A local attacker able to exercise CPU power management while Coresight tracing is in use could trigger this improper state handling, resulting in kernel warnings, system instability, or a denial of service. The impact is limited to availability (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 5.5 Moderate). All Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel and kernel-rt streams are currently listed as not affected because the vulnerable code is not present in those shipped kernels.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Integrity,Confidentiality,Other
Technical Impact: Modify Application Data; Read Application Data; Alter Execution Logic
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
