In the Linux kernel, the following vulnerability has been resolved:
perf: Reject exited events as group leaders
perf_event_remove_on_exec() sets remove-on-exec events to the EXIT state and detaches their group relationships. The event's file descriptor can remain open, however, and perf_event_open() currently accepts that event as a group leader because its early validation rejects only REVOKED and DEAD events.
A new sibling can consequently be linked to the detached leader. When the leader is closed, perf_group_detach() observes that its PERF_ATTACH_GROUP bit is already clear and skips the new sibling. The sibling then retains a group_leader pointer to the freed event.
Reject group leaders in the EXIT state. Perform the check while holding the shared context mutex so that an exec in the target task cannot detach the leader between validation and group attachment.
[peterz: make the earlier test fully consistent]
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernel6.18-modules-extra-commonUpgrade kernel-livepatch-6.18.48-107.148Upgrade perf6.18-debuginfoUpgrade python3-perf6.18-debuginfoUpgrade bpftool6.18Upgrade kernel6.18-debuginfo-common-aarch64Upgrade kernel6.18Upgrade kernel6.18-develUpgrade kernel6.18-debuginfoUpgrade python3-perf6.18Upgrade kernel6.18-toolsUpgrade kernel6.18-tools-develUpgrade microvm-kernel6.18Upgrade kernel6.18-modules-extraUpgrade kernel6.18-headersUpgrade kernel6.18-debuginfo-common-x86_64Upgrade perf6.18Upgrade kernel6.18-tools-debuginfoUpgrade bpftool6.18-debuginfo | Sep 30, 2026 | Aug 26, 2026 |
| Debian | — | Upgrade linux-6.12Upgrade linux | Sep 30, 2026 | Aug 26, 2026 |
| Redhat_linux | — | Upgrade kernel-rtUpgrade kernelNo solution exists | Aug 31, 2026 | Aug 26, 2026 |
| Rocky_linux | — | Upgrade kernel-debug-devel-matchedUpgrade rtlaUpgrade kernel-rt-modulesUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-tools-libs-develUpgrade kernel-uki-virtUpgrade kernel-zfcpdump-modulesUpgrade perfUpgrade kernel-zfcpdump-coreUpgrade kernel-modules-coreUpgrade kernel-devel-matchedUpgrade libperf-debuginfoUpgrade python3-perfUpgrade kernel-rt-debuginfoUpgrade kernel-modulesUpgrade kernel-debug-develUpgrade kernel-debuginfo-common-s390xUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-rt-debug-develUpgrade libperfUpgrade kernel-rt-debug-kvmUpgrade kernel-rt-debug-modules-coreUpgrade kernel-uki-virt-addonsUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-modules-coreUpgrade kernel-zfcpdump-develUpgrade perf-debuginfoUpgrade kernel-tools-libsUpgrade kernel-debuginfo-common-x86_64Upgrade rvUpgrade kernel-modules-extraUpgrade kernel-debugUpgrade kernelUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-modules-extra-matchedUpgrade kernel-debuginfoUpgrade kernel-rt-debug-coreUpgrade bpftoolUpgrade python3-perf-debuginfoUpgrade kernel-debug-modules-extraUpgrade kernel-zfcpdumpUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-rt-debug-debuginfoUpgrade kernel-rtUpgrade kernel-debug-uki-virtUpgrade kernel-rt-modules-extraUpgrade kernel-rt-kvmUpgrade kernel-rt-debug-modulesUpgrade kernel-debug-modules-coreUpgrade kernel-coreUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-toolsUpgrade kernel-debug-modulesUpgrade kernel-debug-coreUpgrade kernel-rt-develUpgrade kernel-debug-debuginfoUpgrade kernel-rt-debugUpgrade kernel-rt-coreUpgrade kernel-develUpgrade bpftool-debuginfoUpgrade kernel-tools-debuginfo | Oct 1, 2026 | Sep 30, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub