perf/core: Detach event groups during remove_on_exec (Linux Linux)

CVE-2026-64556
HIGH 7.8

En bref

Source
NVD
EPSS
EPSS 0.16 % · centile 5 ()
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
Linux
Statut NVD
Received

Description

In the Linux kernel, the following vulnerability has been resolved: perf/core: Detach event groups during remove_on_exec perf_event_remove_on_exec() removes events by calling perf_event_exit_event(). For top-level events, this removes the event from the context with DETACH_EXIT only. This can leave inconsistent group state when a removed event is a group leader and the group contains siblings without remove_on_exec. If the group was active, the surviving siblings can remain active and attached to the removed leader's sibling list, but are no longer represented by a valid group leader on the PMU context active lists. A later close of the removed leader uses DETACH_GROUP and can promote the still-active siblings from this stale group state. The next schedule-in can then add an already-linked active_list entry again, corrupting the PMU context active list. With DEBUG_LIST enabled, this is caught as a list_add double-add in merge_sched_in(). Fix this by detaching group relationships when remove_on_exec removes an event. This preserves the existing task-exit and revoke behavior, while ensuring surviving siblings are ungrouped before the removed event leaves the context.

Faiblesses (CWE)

  • CWE-662 — Improper Synchronization

Références

Scores

VersionScoreVecteurÉvalué par
CVSS 3.1HIGH 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux
CVSS 3.1HIGH 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary)

Références européennes

Avis du CERT-FR

Produits affectés

ProduitVersions
Linux · Linuxaffected 2e498d0a74e5b88a6689ae1b811f247f91ff188e < 1d3e1102273f09180262496658e7eeed8a5a7b59 ; affected 2e498d0a74e5b88a6689ae1b811f247f91ff188e < 4cdb1b3ab96eb1b7eb70bc5c82fede334bd60df2 ; affected 2e498d0a74e5b88a6689ae1b811f247f91ff188e < 39358e856fb89e62e3c8d7389a2dc4ec33dbe90e ; affected 2e498d0a74e5b88a6689ae1b811f247f91ff188e < a2d5d3ee7b6e3953114726b1521e62123ab5b043 ; affected 2e498d0a74e5b88a6689ae1b811f247f91ff188e < 06ccef0434e98058ddae7bcebc901f93d22b7653 ; affected 2e498d0a74e5b88a6689ae1b811f247f91ff188e < 037a3c43edfb597665dd34457cd22b14692f2ba3
Linux · Linuxaffected 5.13 ; unaffected 0 < 5.13 ; unaffected 6.1.191 ≤ 6.1.* ; unaffected 6.6.145 ≤ 6.6.* ; unaffected 6.12.96 ≤ 6.12.* ; unaffected 6.18.39 ≤ 6.18.*

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD