Executive brief
A race condition vulnerability was identified in the Linux kernel's performance monitoring subsystem (perf). This flaw could allow a local attacker to cause a system crash or potentially execute unauthorized code by exploiting a timing issue during event handling. The issue affects how the system manages internal performance data and associated security programs (BPF).
Technical details
A race condition exists in the Linux kernel perf subsystem between __perf_event_overflow() and perf_remove_from_context(). Software events could trigger overflow handling with only preemption disabled rather than hard interrupts (IRQs) disabled. This creates a window where perf_event_exit_event() can execute and free resources, such as BPF programs, while the overflow path still expects them to be present. An attacker with local access could exploit this synchronization failure to trigger a use-after-free condition. Patches have been released across multiple stable kernel branches to ensure IRQs are properly disabled during these callchains.
Affected products
- Linux Linux Kernel 2.6.31 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.77, 6.13 to 6.18.17, 6.19 to 6.19.7
Timeline
- 2026-03-20: advisory: Initial disclosure of CVE-2026-23271
- 2026-03-25: patched: Fixes merged into multiple stable kernel trees
References
- https://git.kernel.org/stable/c/3f89b61dd504c5b6711de9759e053b082f9abf12
- https://git.kernel.org/stable/c/4df1a45819e50993cb351682a6ae8e7ed2d233a0
- https://git.kernel.org/stable/c/4f8d5812337871227bb2c98669a87c306a2f86ef
- https://git.kernel.org/stable/c/5c48fdc4b4623533d86e279f51531a7ba212eb87
- https://git.kernel.org/stable/c/bb190628fe5f2a73ba762a9972ba16c5e895f73e
- https://git.kernel.org/stable/c/c9bc1753b3cc41d0e01fbca7f035258b5f4db0ae