Description

In the Linux kernel, the following vulnerability has been resolved: perf: Reject exited events as group leaders perf_event_remove_on_exec() sets remove-on-exec events to the EXIT state and detaches their group relationships. The event's file descriptor can remain open, however, and perf_event_open() currently accepts that event as a group leader because its early validation rejects only REVOKED and DEAD events. A new sibling can consequently be linked to the detached leader. When the leader is closed, perf_group_detach() observes that its PERF_ATTACH_GROUP bit is already clear and skips the new sibling. The sibling then retains a group_leader pointer to the freed event. Reject group leaders in the EXIT state. Perform the check while holding the shared context mutex so that an exec in the target task cannot detach the leader between validation and group attachment. [peterz: make the earlier test fully consistent]

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-26T15:16:54.387Z",
  "pubdate": "2026-08-26T15:16:54.387Z",
  "executiveSummary": "This vulnerability concerns a use-after-free condition within the Linux kernel's perf subsystem, specifically involving the lifecycle management of event group leaders.\nThe flaw originates from the improper validation of perf event states during the creation of new event groups, allowing an event in the 'EXIT' state to be utilized as a group leader.\nWhen a perf event is marked for removal on exec, it transitions to an EXIT state and detaches from its group relationships. Due to insufficient validation, the perf_event_open syscall fails to reject these detached leaders, allowing new siblings to be attached to an invalid group structure.\nThe primary security impact is a kernel-level use-after-free vulnerability, which could potentially lead to privilege escalation, arbitrary code execution, or system instability.\nExploitation requires the ability to create perf event configurations and trigger race conditions between process execution states and event attachment. This is a local attack vector requiring local user access to the system.",
  "technicalDetails": "The root cause of the vulnerability lies in the race condition between perf_event_remove_on_exec() and the group attachment logic in perf_event_open(). When a process undergoes an execve() syscall, perf_event_remove_on_exec() transitions related events to the PERF_EVENT_STATE_EXIT state and detaches them from existing group structures by clearing the PERF_ATTACH_GROUP bit.\nDespite being in the EXIT state, the event file descriptor remains accessible. The validation routine in perf_event_open() previously only performed explicit checks against REVOKED and DEAD states, failing to account for the EXIT state. This omission allows a malicious actor to define an event currently undergoing the exit process as a group_leader for a new group of siblings.\nThe attack flow proceeds as follows: First, an attacker initiates a performance monitoring session and triggers an event transition to the EXIT state via process execution or configuration. Second, while the event is in this inconsistent state, the attacker invokes perf_event_open() to attach new sibling events to the now-detached leader. Third, the kernel proceeds to link these siblings to the target event.\nBecause the leader has already been detached, perf_group_detach() logic skips updating the state of the newly added sibling when the leader event is eventually closed. Consequently, the sibling retains a dangling pointer to the group_leader structure, which is subsequently freed. This results in a use-after-free condition where the kernel attempts to access or dereference a pointer to a freed memory region associated with the former group leader.\nThe patch resolves this by explicitly rejecting events in the EXIT state during the initial validation phase of perf_event_open(). Furthermore, the check is now performed while holding the shared context mutex. This ensures that the state of the target task and its event relationships remain stable, preventing a concurrent execve() call from detaching the leader during the critical section between validation and the finalization of group attachment. This design change ensures that a group cannot be formed if the proposed leader is in a transient state of destruction, thereby preventing the corruption of the perf_event object references."
}