Executive brief
The Linux kernel's performance event monitoring subsystem (perf) contained a flaw where a detached performance event could still be used as a group leader when attaching new monitoring events. This could lead to a use-after-free condition when the freed event is accessed, potentially allowing local attackers to crash the system or execute arbitrary code with kernel privileges.
Technical details
This is a use-after-free vulnerability in the perf subsystem's event group handling. The root cause is in perf_event_open() syscall validation: when perf_event_remove_on_exec() detaches a group leader by setting it to EXIT state, the file descriptor remains open. However, the early validation in perf_event_open() only rejected REVOKED and DEAD events, not EXIT events, allowing a new sibling to be linked to the detached leader. When the leader is later closed, perf_group_detach() skips the new sibling (seeing PERF_ATTACH_GROUP already clear), leaving the sibling with a dangling pointer to freed memory. The fix adds validation to reject EXIT-state events as group leaders, with the check performed while holding the context mutex to prevent race conditions with exec operations. The vulnerability affects the perf subsystem across multiple kernel versions and requires local access (a process must be able to make perf_event_open syscalls).
Affected products
- Linux Linux Kernel Affected versions include Linux 2.6.11 through 6.x; patched in version addressing commit fa091f46c3833fb22384f10eade2b4e1e1d0b278
Timeline
- 2026-08-26: disclosed: Vulnerability published/disclosed
- 2026-08-23: patched: Fix committed by Greg Kroah-Hartman to stable kernel series