Linux kernel perf/core: exited event accepted as group leader leaves a sibling pointing at freed memory

Impact

perf_event_remove_on_exec() moves remove-on-exec events to the EXIT state and detaches their group links, but the file descriptor stays open and perf_event_open()'s early validation only rejected REVOKED and DEAD events. A new sibling can therefore be attached to an already-detached leader; when that leader is closed, perf_group_detach() sees PERF_ATTACH_GROUP already cleared and skips the sibling, leaving the sibling holding a group_leader pointer to freed memory. That is a local kernel use-after-free, the same class as CVE-2026-74637 in the same subsystem. On a GPU node it matters where profiling is enabled for tenants: fleets that relax kernel.perf_event_paranoid so users can run perf or GPU profilers on their own pods hand tenants the primitive, and a kernel UAF on a shared node is both an availability and a privilege-escalation problem.

Who can reach it

Local user able to call perf_event_open() and create event groups, subject to kernel.perf_event_paranoid and CAP_PERFMON, in a task that performs an exec with remove-on-exec events attached. Not remote. Where perf_event_paranoid keeps unprivileged perf disabled, tenants cannot reach it.

What to do

Apply the stable fix, which rejects EXIT-state group leaders and performs the check under the shared context mutex so an exec cannot detach the leader between validation and attachment; three stable commits are listed and no fixed release version is given in the record. Rollout is a patched kernel plus a per-node reboot, so drain GPU workloads first. Interim mitigation is to raise kernel.perf_event_paranoid so unprivileged perf event creation is denied.

References

Related entries

• Linux kernel CephFS client: readers hang indefinitely after cap revocation leaves stale mds_wantedCVE-2026-80527 · Linux kernel CephFS client (__ceph_get_caps / ceph_renew_caps, stale cap->mds_wanted)Unscored
• Linux kernel CephFS client: reclaim during MDS reply handling crashes the kernel via ext4 journal_infoCVE-2026-80528 · Linux kernel CephFS client (handle_reply / current->journal_info vs direct reclaim)Unscored
• Linux kernel libceph: out-of-bounds read in decode_watchers() from a zero-length struct_lenCVE-2026-80557 · Linux kernel libceph (decode_watchers(), CEPH_OSD_OP_LIST_WATCHERS reply parsing)Unscored
• Linux kernel libceph: unvalidated primary_temp OSD index causes out-of-bounds array readsCVE-2026-80558 · Linux kernel libceph (get_temp_osds(), unvalidated primary_temp OSD index)Unscored
• Linux kernel libceph: unchecked decodes in decode_locker() let a malicious OSD read out of boundsCVE-2026-80561 · Linux kernel libceph (cls_lock_client decode_locker)Unscored
• Microsoft Hyper-V: vmswitch fails to validate guest OID requestsCVE-2021-28476 · Microsoft Hyper-VCritical