Description

In the Linux kernel, the following vulnerability has been resolved: perf: Fix addr_filter_ranges lifetime Lee Jia Jie reported that since event::addr_filter_ranges is used under RCU, it should be RCU freed.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-24T17:17:15.233Z",
  "pubdate": "2026-09-24T17:17:15.233Z",
  "executiveSummary": "The vulnerability identified is a Use-After-Free (UAF) flaw within the Linux kernel's perf subsystem, specifically affecting the handling of address filter ranges.\nThe root cause originates from an incorrect memory management lifecycle for the event::addr_filter_ranges structure, which is accessed within Read-Copy-Update (RCU) protected read-side critical sections.\nBecause the memory is not freed using RCU-aware reclamation methods, a race condition can occur where the memory is deallocated while still being accessed by other execution contexts, leading to kernel-mode use-after-free conditions.\nThis vulnerability poses a significant risk to system stability and security, as it potentially allows for memory corruption or arbitrary code execution within the kernel context.\nAn attacker capable of triggering perf event operations could theoretically exploit this timing-dependent vulnerability to achieve a denial-of-service (system crash) or escalate privileges if they can influence the kernel heap layout during the window of vulnerability.\nSuccessful exploitation requires local access to the system to interact with the perf subsystem, though it does not necessarily require high-level administrative privileges, depending on system-wide perf configuration settings.",
  "technicalDetails": "The vulnerability resides in the perf subsystem's management of address filter ranges, which are utilized for hardware-assisted filtering of performance monitoring data. The event structure member 'addr_filter_ranges' serves as the anchor for these filtering configurations.\nIn the Linux kernel, RCU is frequently used to provide low-overhead synchronization for frequently accessed, rarely modified data structures. Code accessing these structures enters an RCU read-side critical section, ensuring that the structure remains valid for the duration of the critical section.\nThe flaw occurs because the 'addr_filter_ranges' structure is not properly integrated into the RCU reclamation subsystem. When an 'event' object is modified or destroyed, the associated address filter ranges must be reclaimed safely. If the kernel performs a standard synchronous free (such as kfree()) while an RCU reader is still traversing or referencing the object, a use-after-free scenario is triggered.\nThe exploitation flow proceeds as follows: First, an attacker initiates a performance monitoring session that requires address filtering. Second, the attacker triggers an event configuration change or an event teardown concurrent with a perf system call (e.g., perf_event_open or ioctl) that attempts to traverse the 'addr_filter_ranges' list under an RCU lock. Third, if the cleanup routine proceeds with an immediate free, the RCU reader will subsequently access the now-freed memory location, causing a kernel panic or a potential exploitable memory state.\nThe lack of RCU-safe reclamation prevents the deferred destruction required to guarantee that no concurrent readers remain in the critical section. By manipulating kernel heap allocations or triggering frequent event creation/destruction cycles, an attacker can influence the reuse of the freed memory block, potentially hijacking kernel control flow or corrupting sensitive kernel data structures.\nThis vulnerability is restricted to environments where the perf subsystem is exposed to userspace. While many distributions restrict perf access via the 'perf_event_paranoid' sysctl, systems where this is set to lower values (e.g., <= 1) are directly exposed to unprivileged users, significantly lowering the barrier to exploitation. There is no requirement for network exposure, as this is a local kernel exploit."
}