Linux Kernel CVE-2026-64556

Exploitation requires local code execution as a user permitted to call perf_event_open() (governed by kernel.perf_event_paranoid and/or CAP_PERFMON), and the ability to construct a perf event group where the group leader has the remove_on_exec attribute set while at least one sibling does not, with the group in an active state. The attacker must then cause the leader-owning task to exec (invoking perf_event_remove_on_exec with DETACH_EXIT), and subsequently close the removed leader (DETACH_GROUP) to promote the still-active, stale siblings, so the next schedule-in re-adds an already-linked active_list entry. Limiting factors: exploitation is local only (AV:L), needs at least low privileges/perf access (PR:L) - so hosts with perf_event_paranoid tightened or without unprivileged perf are not exposed via unprivileged users - and reliably weaponizing the resulting list corruption depends on kernel version, DEBUG_LIST configuration, and heap layout.

The signals are consistent but point to a serious-yet-not-urgent local issue. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U with C/I/A all High) correctly frames this as a locally exploitable memory-corruption bug requiring an authenticated (PR:L) local user, no user interaction. EPSS is very low (0.16%, 5th percentile) and there is no KEV listing and no public exploit identified, so mass or opportunistic exploitation is unlikely; realistic risk is a skilled local attacker attempting privilege escalation from an existing foothold or breaking sandbox isolation. Weaponizing a controlled double list_add into reliable code execution is non-trivial and depends on kernel config (e.g. perf_event_paranoid, CAP_PERFMON) and heap/list layout, so the AC:L rating may understate practical exploitation difficulty. Priority is moderate: patch on multi-tenant, container, or untrusted-local-user systems; lower urgency on single-user or tightly restricted hosts.

A local unprivileged (or low-privileged) user on a shared or container host opens a perf event group whose leader carries the remove_on_exec attribute while its siblings do not, keeps the group active, and triggers exec to strand the active siblings under a removed leader. They then close the leader to promote the stale siblings and force a schedule-in, causing a double list_add that corrupts the PMU context active list and can be shaped toward kernel memory corruption and privilege escalation. No public exploit is identified at time of analysis; the low AC and no-UI vector make it attractive for local attackers already on the system.