Executive brief
A vulnerability was identified in the Linux kernel's performance monitoring subsystem (perf). When a program starts a new process, certain performance monitoring events are supposed to be cleaned up; however, a flaw in how these events were grouped could lead to internal system memory corruption. This could potentially result in a system crash or unstable behavior, impacting the availability of the affected machine.
Technical details
The vulnerability exists in the perf/core component of the Linux kernel, specifically within the perf_event_remove_on_exec() function. When this function calls perf_event_exit_event() for top-level events, it previously only used the DETACH_EXIT flag. If the removed event was a group leader with siblings not marked for removal, those siblings could remain in an inconsistent state, still attached to the removed leader's list but not represented on the PMU context active lists. A subsequent close of the leader or a schedule-in event could trigger a list_add double-add, leading to kernel list corruption. This is fixed by ensuring group relationships are detached when remove_on_exec is triggered.
Affected products
- Linux Linux Kernel 5.13 to 6.12.96, 6.6.145, 6.18.39
Timeline
- 2026-07-29: advisory: CVE-2026-64556 published by NVD
- 2026-07-02: patched: Fix committed to Linux stable tree by Peter Zijlstra
References
- https://git.kernel.org/stable/c/037a3c43edfb597665dd34457cd22b14692f2ba3
- https://git.kernel.org/stable/c/06ccef0434e98058ddae7bcebc901f93d22b7653
- https://git.kernel.org/stable/c/39358e856fb89e62e3c8d7389a2dc4ec33dbe90e
- https://git.kernel.org/stable/c/4cdb1b3ab96eb1b7eb70bc5c82fede334bd60df2
- https://git.kernel.org/stable/c/a2d5d3ee7b6e3953114726b1521e62123ab5b043