Linux Kernel EUVD-2026-32823

The Linux kernel's static tracepoint framework supports subsystem-specific registration callbacks through the tracepoint_ext structure's regfunc()/unregfunc() pair. On a 0→1 probe count transition, tracepoint_add_func() calls ext->regfunc() to establish subsystem state, then invokes func_add() to install the probe into the probe array via allocate_probes(). If allocate_probes() cannot allocate memory and returns -ENOMEM, the error path returns immediately without calling ext->unregfunc() to unwind the regfunc() side effects - an asymmetric cleanup failure. For syscall tracepoints specifically, syscall_regfunc() increments the global sys_tracepoint_refcount and calls set_syscall_tracepoint() on every task_struct via for_each_process(), setting TIF_SYSCALL_TRACEPOINT per-thread. With the refcount stuck non-zero, the kernel's syscall entry/exit paths continue executing tracepoint hooks for all threads with no registered consumer. Affected products are confirmed by CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* across multiple stable version branches starting from commit 8cf868affdc459beee1a941df0cfaba1673740e3. No CWE is formally assigned by NVD, but the root cause class is incomplete error-path cleanup, analogous to CWE-459 (Incomplete Cleanup) or CWE-755 (Improper Handling of Exceptional Conditions).