Linux kernel perf: software events run the overflow path with IRQs enabled, racing teardown of the event's BPF program

Impact

__perf_event_overflow() assumed IRQs were disabled on every call path, but software events can reach it with only preemption disabled. That opens a race against perf_event_exit_event() and the rest of the teardown path, which frees state the overflow handler still expects to be there - the attached BPF program among it - so the handler can run against freed kernel objects. Distinct flaw and distinct fix from the other perf issue in this batch: the problem here is the locking context of the overflow path, not ring-buffer refcounting. Exposure on a GPU node again follows profiling policy; where tenants can open software perf events with BPF programs attached, a local user has a route at a kernel use-after-free. Siemens also lists affected SIMATIC devices running its Linux subsystem, which is irrelevant to datacenter fleets but explains the extended product list on the record.

Who can reach it

Local user able to create perf software events, in practice with a BPF program attached - unprivileged where perf_event_paranoid is relaxed or CAP_PERFMON/CAP_BPF is granted to containers. No network path.

What to do

Take the stable kernel update that forces IRQs off across all __perf_event_overflow() call paths; five stable branches carry it. Rollout is drain, install kernel, reboot. Interim mitigation is the same lever as for the other perf fix: restrict perf_event_open for unprivileged users and remove CAP_PERFMON and CAP_BPF from tenant workloads.

References

Related entries

• Linux kernel io_uring: task-work flag write can land on freed rings during a concurrent ring resizeCVE-2026-23275 · Linux kernel io_uring (ring resize vs task-work flag update)High
• Linux kernel vmwgfx: failed handle lookup returns success, leading to uninitialized and out-of-bounds accessCVE-2026-23317 · Linux kernel vmwgfx (vmw_translate_ptr error path)High
• Linux kernel (drivers/iommu): Unbinding shared virtual addressing touches the mm's IOMMU state after the domain-freeCVE-2026-23429 · Linux kernel (drivers/iommu)High
• Linux kernel NFSD: reads on an open /proc/fs/nfs/exports fd walk a freed export cache after netns teardownCVE-2026-31403 · Linux kernel NFSD (/proc/fs/nfs/exports namespace reference)High
• Linux kernel (net/xfrm): Flushing xfrm states during namespace cleanup re-arms the NAT-keepalive delayed work after itCVE-2026-31406 · Linux kernel (net/xfrm)High
• Linux kernel (crypto algif_aead): Incorrect resource transfer between spheres in algif_aead (reverted to out-of-placeCVE-2026-31431 · Linux kernel (crypto algif_aead)High