In the Linux kernel, the following vulnerability has been resolved:
perf: Fix perf_pending_task() UaF
Per syzbot it is possible for perf_pending_task() to run after the event is free()'d. There are two related but distinct cases:
- the task_work was already queued before destroying the event; - destroying the event itself queues the task_work.
The first cannot be solved using task_work_cancel() since perf_release() itself might be called from a task_work (____fput), which means the current->task_works list is already empty and task_work_cancel() won't be able to find the perf_pending_task() entry.
The simplest alternative is extending the perf_event lifetime to cover the task_work.
The second is just silly, queueing a task_work while you know the event is going away makes no sense and is easily avoided by re-arranging how the event is marked STATE_DEAD and ensuring it goes through STATE_OFF on the way down.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade python-perfUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-toolsUpgrade kernel-headersUpgrade python-perf-debuginfoUpgrade perf-debuginfoUpgrade kernel-livepatch-5.15.86-53.137Upgrade perfUpgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernelUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfoUpgrade bpftoolUpgrade kernel-develUpgrade kernel-tools-devel | Jan 22, 2025 | Oct 21, 2024 |
| Debian | — | Upgrade linux | Oct 23, 2024 | Oct 23, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Oct 21, 2024 |
| Ubuntu | — | Upgrade linux-aws-5.15Upgrade linux-hwe-5.15Upgrade linux-nvidia-tegra-5.15Upgrade linux-azureUpgrade linux-azure-fdeUpgrade linux-gkeUpgrade linux-raspiUpgrade linux-realtimeUpgrade linux-lowlatency-hwe-5.15Upgrade linux-awsUpgrade linux-bluefieldUpgrade linux-kvmUpgrade linux-intel-iotgUpgrade linux-azure-5.15Upgrade linux-gcp-5.15Upgrade linux-lowlatencyUpgrade linux-oracle-5.15Upgrade linux-oracleUpgrade linux-gcpUpgrade linux-nvidiaUpgrade linux-riscv-5.15Upgrade linuxUpgrade linux-ibmUpgrade linux-intel-iot-realtimeUpgrade linux-gkeop-5.15Upgrade linux-intel-iotg-5.15Upgrade linux-azure-fde-5.15Upgrade linux-gkeop | Nov 19, 2024 | Oct 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub