Linux kernel perf/core: remove_on_exec leaves stale group state, corrupting the PMU active list

Impact

When perf_event_remove_on_exec() removes a group leader, siblings without remove_on_exec can stay active while attached to the removed leader's sibling list, no longer represented by a valid leader on the PMU context active lists. A later close of the leader uses DETACH_GROUP and can promote those still-active siblings from stale state, so the next schedule-in re-adds an already-linked entry and corrupts the PMU context active list - caught as a list_add double-add with DEBUG_LIST. Linked-list corruption in core scheduling code is a credible local escalation primitive, and GPU fleets commonly expose perf to tenants for profiling (DCGM, Nsight, perf-based observability sidecars).

Who can reach it

Local user able to call perf_event_open with remove_on_exec, which depends on perf_event_paranoid and any seccomp policy in front of it. No authentication beyond a shell or container on the node.

What to do

Apply the stable fix that detaches group relationships during remove_on_exec and reboot the node. Where profiling is not needed, raising kernel.perf_event_paranoid to 3 or blocking perf_event_open in the container seccomp profile removes tenant reach in the meantime.

References

Related entries

• Linux kernel BPF TCP iterator: double socket release on batch realloc failure panics the nodeCVE-2026-64575 · Linux kernel BPF TCP iterator (bpf_iter_tcp_batch)High
• Linux kernel (net/xfrm): Setting a per-socket IPsec policy reset the socket's destination cache non-atomically whileCVE-2026-64581 · Linux kernel (net/xfrm)High
• Linux kernel iomap: zero-length write range underflows into an out-of-bounds bitmap_set()CVE-2026-68145 · Linux kernel iomap (ifs_set_range_dirty / ifs_set_range_uptodate)High
• Linux kernel libceph: use-after-free reading the monmap debugfs file during client teardownCVE-2026-68153 · Linux kernel libceph (per-client debugfs files vs client teardown)High
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): An out-of-bounds access in the amdkfd (KFD computeCVE-2026-68257 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)High
• Linux kernel sockmap: cork use-after-free when two threads send on the same socketCVE-2026-68284 · Linux kernel BPF sockmap (tcp_bpf_sendmsg cork handling)High