EUVD-2026-64574
GHSA-f4j9-rgf4-2rmj
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Race condition requiring concurrent CPU hotplug timing warrants AC:H over vendor-assigned AC:L; PR:L because unprivileged perf_event_open access suffices on default configurations.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
perf/core: Fix group leader use-after-free after sibling detach
perf_group_detach() handles leader and sibling detach differently. When the group leader is detached, all siblings are promoted to singleton events and their group_leader pointer is reset to themselves. When a sibling is detached, it is removed from the leader's sibling_list, but its group_leader pointer is left pointing at the old leader.
That is harmless when the sibling is being closed and freed immediately, as in the DETACH_DEAD path. It is not safe when the sibling is detached but kept alive, such as during CPU hotplug with DETACH_GROUP. In that case the sibling is removed from the context, while its file descriptor can still keep it alive.
A typical failing sequence is:
- A group contains leader L and sibling S.
- CPU hot-unplug detaches S with DETACH_GROUP, removing it from
L->sibling_list but leaving S->group_leader == L.
- L is later closed and freed.
- A PERF_IOC_FLAG_GROUP ioctl on S follows S->group_leader and
dereferences the freed leader.
This was reproduced by running the perf event fuzzer, CPU hotplug, and a stress workload concurrently:
Unable to handle kernel paging request at virtual address 006b6b6b6b6b6cdb CPU: 2 PID: 12489 Comm: perf_fuzzer 6.18.7 PREEMPT pc : perf_ioctl+0x34c/0xc68 x20: ffffff89a3fa2c70 x8 : 6b6b6b6b6b6b6b6b Code: 943c4a0e 340047a0 f9404a94 f9411e88 (f940b908) Call trace: perf_ioctl+0x34c/0xc68 (P) __arm64_sys_ioctl+0xa0/0xf4 invoke_syscall+0x58/0xe4 el0_svc_common+0xa8/0xdc do_el0_svc+0x1c/0x28 el0_svc+0x40/0xc0 el0t_64_sync_handler+0x68/0xdc el0t_64_sync+0x1c4/0x1c8
The fault happened in perf_ioctl(), where perf_event_for_each() follows the stale group_leader pointer and perf_event_for_each_child() then dereferences the freed leader's context.
Fix the use-after-free by promoting the detached sibling to a singleton. Also fix __event_disable() cgroup accounting and event state change.
AnalysisAI
Use-after-free in the Linux kernel perf/core subsystem allows a local low-privileged user to dereference freed kernel memory by racing CPU hot-unplug against perf event group management. When a sibling event is detached via DETACH_GROUP during CPU hotplug, its group_leader pointer is not reset; if the leader is subsequently freed while the sibling's file descriptor remains open, a PERF_IOC_FLAG_GROUP ioctl on the sibling follows the stale pointer into freed memory, potentially enabling kernel crash or privilege escalation to root. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a local user account with access to perf_event_open(), which on default Linux configurations (kernel.perf_event_paranoid <= 2) is available to unprivileged users; systems hardened with paranoid=3 or CONFIG_PERF_EVENTS=n are not exploitable by non-root users. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 7.8 HIGH with AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H overstates accessibility: AC:L implies straightforward exploitation, but the attack requires precise timing of a CPU hotplug event relative to perf group lifecycle and ioctl - a race condition that more accurately maps to AC:H. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local user creates a perf event group with a leader and sibling bound to a specific CPU, then administratively offlines that CPU (echo 0 > /sys/devices/system/cpu/cpuN/online), causing DETACH_GROUP to remove the sibling from the leader's list while leaving the sibling's group_leader pointing to the now-detached leader. The attacker then closes the leader file descriptor (triggering its kernel-memory release) and immediately issues a PERF_IOC_FLAG_GROUP ioctl on the still-open sibling file descriptor, dereferencing the freed leader structure - resulting in a kernel panic at minimum or, if the freed memory has been reallocated and overwritten with attacker-controlled data, potential kernel code execution and privilege escalation to root. … |
| Remediation | Upgrade the Linux kernel to a patched stable release: 6.18.45, 7.1.9, or 7.2, depending on the active stable branch. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory Linux systems and identify kernel versions to assess exposure; determine whether perf_event_open is available to unprivileged users. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today