CVE-2026-64556 (GCVE-0-2026-64556)

Vulnerability from cvelistv5 – Published: 2026-07-29 08:01 – Updated: 2026-08-17 04:57
VLAI
Title
perf/core: Detach event groups during remove_on_exec
Summary
In the Linux kernel, the following vulnerability has been resolved: perf/core: Detach event groups during remove_on_exec perf_event_remove_on_exec() removes events by calling perf_event_exit_event(). For top-level events, this removes the event from the context with DETACH_EXIT only. This can leave inconsistent group state when a removed event is a group leader and the group contains siblings without remove_on_exec. If the group was active, the surviving siblings can remain active and attached to the removed leader's sibling list, but are no longer represented by a valid group leader on the PMU context active lists. A later close of the removed leader uses DETACH_GROUP and can promote the still-active siblings from this stale group state. The next schedule-in can then add an already-linked active_list entry again, corrupting the PMU context active list. With DEBUG_LIST enabled, this is caught as a list_add double-add in merge_sched_in(). Fix this by detaching group relationships when remove_on_exec removes an event. This preserves the existing task-exit and revoke behavior, while ensuring surviving siblings are ungrouped before the removed event leaves the context.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 2e498d0a74e5b88a6689ae1b811f247f91ff188e , < 4cdb1b3ab96eb1b7eb70bc5c82fede334bd60df2 (git)
Affected: 2e498d0a74e5b88a6689ae1b811f247f91ff188e , < 39358e856fb89e62e3c8d7389a2dc4ec33dbe90e (git)
Affected: 2e498d0a74e5b88a6689ae1b811f247f91ff188e , < a2d5d3ee7b6e3953114726b1521e62123ab5b043 (git)
Affected: 2e498d0a74e5b88a6689ae1b811f247f91ff188e , < 06ccef0434e98058ddae7bcebc901f93d22b7653 (git)
Affected: 2e498d0a74e5b88a6689ae1b811f247f91ff188e , < 037a3c43edfb597665dd34457cd22b14692f2ba3 (git)
Create a notification for this product.
Linux Linux Affected: 5.13
Unaffected: 0 , < 5.13 (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.96 , ≤ 6.12.* (semver)
Unaffected: 6.18.39 , ≤ 6.18.* (semver)
Unaffected: 7.1.4 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/events/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4cdb1b3ab96eb1b7eb70bc5c82fede334bd60df2",
              "status": "affected",
              "version": "2e498d0a74e5b88a6689ae1b811f247f91ff188e",
              "versionType": "git"
            },
            {
              "lessThan": "39358e856fb89e62e3c8d7389a2dc4ec33dbe90e",
              "status": "affected",
              "version": "2e498d0a74e5b88a6689ae1b811f247f91ff188e",
              "versionType": "git"
            },
            {
              "lessThan": "a2d5d3ee7b6e3953114726b1521e62123ab5b043",
              "status": "affected",
              "version": "2e498d0a74e5b88a6689ae1b811f247f91ff188e",
              "versionType": "git"
            },
            {
              "lessThan": "06ccef0434e98058ddae7bcebc901f93d22b7653",
              "status": "affected",
              "version": "2e498d0a74e5b88a6689ae1b811f247f91ff188e",
              "versionType": "git"
            },
            {
              "lessThan": "037a3c43edfb597665dd34457cd22b14692f2ba3",
              "status": "affected",
              "version": "2e498d0a74e5b88a6689ae1b811f247f91ff188e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/events/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "lessThan": "5.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/core: Detach event groups during remove_on_exec\n\nperf_event_remove_on_exec() removes events by calling\nperf_event_exit_event(). For top-level events, this removes the event from\nthe context with DETACH_EXIT only.\n\nThis can leave inconsistent group state when a removed event is a group\nleader and the group contains siblings without remove_on_exec. If the group\nwas active, the surviving siblings can remain active and attached to the\nremoved leader\u0027s sibling list, but are no longer represented by a valid\ngroup leader on the PMU context active lists.\n\nA later close of the removed leader uses DETACH_GROUP and can promote the\nstill-active siblings from this stale group state. The next schedule-in can\nthen add an already-linked active_list entry again, corrupting the PMU\ncontext active list.\n\nWith DEBUG_LIST enabled, this is caught as a list_add double-add in\nmerge_sched_in().\n\nFix this by detaching group relationships when remove_on_exec removes an\nevent. This preserves the existing task-exit and revoke behavior, while\nensuring surviving siblings are ungrouped before the removed event leaves\nthe context."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is triggered entirely through local syscalls \u2014 `perf_event_open(2)` to build the event group and `execve(2)`/`close(2)` to trigger the stale-group corruption. No network or physical vector is involved.\nAC:L - The attacker controls the entire deterministic sequence: create a pinned/enabled group with a `remove_on_exec` leader plus non-`remove_on_exec` siblings, exec, then close the leader. No race the attacker cannot influence is required.\nPR:L - An unprivileged user can open perf events on their own task with `exclude_kernel=1` even at the default `perf_event_paranoid=2`, requiring no capability. Basic local user access suffices.\nUI:N - The attacking process performs every step itself (open, exec, close); no action from any other user is needed.\nS:U - The corruption stays within the kernel\u0027s own security authority (PMU context list in kernel heap); it does not cross a hypervisor/IOMMU/sandbox boundary.\nC:H - Corrupting the doubly-linked active list of `perf_event` objects yields pointer manipulation over heap-embedded list nodes, which can be leveraged to read adjacent/freed kernel memory for information disclosure.\nI:H - A double `list_add`/subsequent list operations on a corrupted list provide write-what-where-style primitives against attacker-influenceable heap objects, enabling arbitrary modification and control-flow hijack.\nA:H - The list corruption reliably produces a kernel crash/oops (caught as a list_add double-add under DEBUG_LIST, silent corruption and panic otherwise), causing denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:57:34.489Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4cdb1b3ab96eb1b7eb70bc5c82fede334bd60df2"
        },
        {
          "url": "https://git.kernel.org/stable/c/39358e856fb89e62e3c8d7389a2dc4ec33dbe90e"
        },
        {
          "url": "https://git.kernel.org/stable/c/a2d5d3ee7b6e3953114726b1521e62123ab5b043"
        },
        {
          "url": "https://git.kernel.org/stable/c/06ccef0434e98058ddae7bcebc901f93d22b7653"
        },
        {
          "url": "https://git.kernel.org/stable/c/037a3c43edfb597665dd34457cd22b14692f2ba3"
        }
      ],
      "title": "perf/core: Detach event groups during remove_on_exec",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64556",
    "datePublished": "2026-07-29T08:01:46.864Z",
    "dateReserved": "2026-07-19T15:36:31.796Z",
    "dateUpdated": "2026-08-17T04:57:34.489Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64556",
      "date": "2026-10-03",
      "epss": "0.00124",
      "percentile": "0.01877"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.