CVE-2026-64556

Received Received - Intake

Linux Kernel perf/core Event Group Detachment Vulnerability

Publication date: 2026-07-29

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: perf/core: Detach event groups during remove_on_exec perf_event_remove_on_exec() removes events by calling perf_event_exit_event(). For top-level events, this removes the event from the context with DETACH_EXIT only. This can leave inconsistent group state when a removed event is a group leader and the group contains siblings without remove_on_exec. If the group was active, the surviving siblings can remain active and attached to the removed leader's sibling list, but are no longer represented by a valid group leader on the PMU context active lists. A later close of the removed leader uses DETACH_GROUP and can promote the still-active siblings from this stale group state. The next schedule-in can then add an already-linked active_list entry again, corrupting the PMU context active list. With DEBUG_LIST enabled, this is caught as a list_add double-add in merge_sched_in(). Fix this by detaching group relationships when remove_on_exec removes an event. This preserves the existing task-exit and revoke behavior, while ensuring surviving siblings are ungrouped before the removed event leaves the context.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-08-17

Generated

2026-08-18

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-17

NVD

CVE-2026-64556

EUVD

EUVD-2026-50201

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where removing an event during execution can leave inconsistent group states. If a removed event is a group leader with active siblings, those siblings may remain attached to a stale list. Later operations can corrupt the PMU context active list, potentially causing crashes or other issues.

Detection Guidance

This vulnerability is specific to the Linux kernel's perf subsystem and may not have direct network detection methods. Check kernel logs for PMU context errors or list corruption warnings, especially with DEBUG_LIST enabled. Monitor for crashes or hangs during perf event operations.

Impact Analysis

An attacker with local access could exploit this to cause a denial of service, crash the system, or potentially escalate privileges by corrupting kernel data structures. Systems using perf for performance monitoring are most at risk.

Compliance Impact

This vulnerability in the Linux kernel's perf subsystem could lead to memory corruption or undefined behavior in the PMU context active lists. While it does not directly impact data privacy or security controls, such low-level memory issues could potentially undermine system integrity, which may indirectly affect compliance with standards requiring robust system stability and security controls.

Mitigation Strategies

Update the Linux kernel to the latest patched version that includes the fix for CVE-2026-64556. Avoid using perf_event_open syscalls in untrusted environments until patched. Monitor system stability and kernel logs for signs of active exploitation or crashes.

Hi! I’m here to help you understand CVE-2026-64556. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70