CVE-2026-23014

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2026-01-28

Last updated on: 2026-04-27

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: perf: Ensure swevent hrtimer is properly destroyed With the change to hrtimer_try_to_cancel() in perf_swevent_cancel_hrtimer() it appears possible for the hrtimer to still be active by the time the event gets freed. Make sure the event does a full hrtimer_cancel() on the free path by installing a perf_event::destroy handler.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-01-28

Last Modified

2026-04-27

Generated

2026-07-06

AI Q&A

2026-01-29

EPSS Evaluated

2026-07-05

NVD

CVE-2026-23014

EUVD

EUVD-2026-4926

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	6.19
linux	linux_kernel	6.19
linux	linux_kernel	6.19
linux	linux_kernel	6.19
linux	linux_kernel	6.19
linux	linux_kernel	6.18
linux	linux_kernel	6.19
linux	linux_kernel	6.19
linux	linux_kernel	6.19
linux	linux_kernel	From 6.17.8 (inc) to 6.18 (exc)
linux	linux_kernel	From 6.18.1 (inc) to 6.18.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel relates to the perf subsystem's handling of high-resolution timers (hrtimers) in swevent. Specifically, after a change to the function hrtimer_try_to_cancel() within perf_swevent_cancel_hrtimer(), it became possible for the hrtimer to remain active even when the associated event is freed. The fix ensures that the event fully cancels the hrtimer during the free path by adding a perf_event::destroy handler to properly destroy the swevent hrtimer.

Impact Analysis

If the hrtimer is not properly destroyed when the event is freed, it could lead to use-after-free conditions or other timing-related issues in the kernel's perf subsystem. This might cause system instability, crashes, or potential security risks due to improper resource management.

Mitigation Strategies

Apply the patch or update to the Linux kernel version that includes the fix for this vulnerability, which ensures the swevent hrtimer is properly destroyed by installing a perf_event::destroy handler and performing a full hrtimer_cancel() on the free path.

Hi! I’m here to help you understand CVE-2026-23014. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70