EUVD-2026-66583
GHSA-4mpw-g9mg-jrm7
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local low-privilege access required; EXIT state persists post-exec removing timing constraint; UAF yields full kernel memory corruption with no scope change.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
perf: Reject exited events as group leaders
perf_event_remove_on_exec() sets remove-on-exec events to the EXIT state and detaches their group relationships. The event's file descriptor can remain open, however, and perf_event_open() currently accepts that event as a group leader because its early validation rejects only REVOKED and DEAD events.
A new sibling can consequently be linked to the detached leader. When the leader is closed, perf_group_detach() observes that its PERF_ATTACH_GROUP bit is already clear and skips the new sibling. The sibling then retains a group_leader pointer to the freed event.
Reject group leaders in the EXIT state. Perform the check while holding the shared context mutex so that an exec in the target task cannot detach the leader between validation and group attachment.
[peterz: make the earlier test fully consistent]
AnalysisAI
Use-after-free in the Linux kernel perf subsystem allows a local low-privileged user to obtain a dangling pointer to a freed perf_event structure, enabling memory corruption with full confidentiality, integrity, and availability impact. Affected are stable kernel series 6.6.x, 6.12.x, 6.18.x (up to 6.18.46), and 7.1.x (up to 7.1.10). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local unprivileged access to the target system and the ability to invoke the perf_event_open syscall, which is gated by /proc/sys/kernel/perf_event_paranoid (values 0 or 1 permit unprivileged use; value 2 restricts to root; value 3 blocks entirely). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 3.1 score of 7.8 High (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects local privilege escalation via UAF. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local user with standard shell access opens a perf event group with the PERF_FLAG_FD_NO_GROUP flag and remove-on-exec set, triggers exec on a child process to advance the leader event to EXIT state while keeping the fd open, then calls perf_event_open() with the now-EXIT-state fd as the group leader to attach a sibling. When the leader fd is closed, the sibling's group_leader pointer references freed kernel memory, which the attacker can manipulate via heap grooming techniques for kernel privilege escalation. … |
| Remediation | Apply the vendor-released stable kernel patches available via kernel.org. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems running affected kernel versions (6.6.x, 6.12.x, 6.18.x up to 6.18.46, 7.1.x up to 7.1.10) and prioritize multi-tenant platforms and shared infrastructure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today