Linux kernel perf: addr_filter_ranges freed without RCU grace period, leaving a use-after-free

Impact

perf_event::addr_filter_ranges is read under RCU but was not freed through RCU, so a concurrent reader can touch the freed array - a classic use-after-free in core kernel perf. The record is terse: it states the lifetime bug and the fix, and no exploitation detail. Exposure depends entirely on who may call perf_event_open with address filters; GPU nodes that run fleet-wide profiling or that have relaxed perf_event_paranoid for tenant benchmarking widen that set considerably, and a host-kernel UAF on a shared GPU host is a cross-tenant problem.

Who can reach it

Local user able to call perf_event_open and set address filters. Gated by kernel.perf_event_paranoid and by CAP_PERFMON; not reachable from a pod with perf syscalls blocked.

What to do

Take a stable kernel carrying the RCU-free fix for addr_filter_ranges (commits in the record), which means a kernel update and a reboot of each node. Until then, check kernel.perf_event_paranoid on GPU hosts and do not leave it relaxed for tenant workloads.

References

Related entries

• sudo: TZ from the calling user shifts NOTBEFORE/NOTAFTER windows, reviving expired rulesCVE-2026-96512 · sudo (NOTBEFORE/NOTAFTER sudoers time restrictions)High
• Linux slab allocator: ABA race in the optimistic freelist return corrupts the partial listCVE-2026-97941 · Linux kernel mm/slab (__slab_try_return_freelist ABA race)High
• Linux AMD IOMMU: sign-discarding error check lets nested domains use an unallocated domain IDCVE-2026-98002 · Linux kernel iommu/amd (amd_iommu_alloc_domain_nested error check)High
• Linux kernel BPF: per-CPU map updates index by logical CPU id, reading past the update bufferCVE-2026-98149 · Linux kernel BPF per-CPU map update paths (array, hash, cgroup storage)High
• Linux kernel RDMA/rxe: ODP write paths accept read-only pages, letting RDMA traffic overwrite the page cacheCVE-2026-98361 · Linux kernel RDMA/rxe (soft-RoCE on-demand paging write path)High
• Linux kernel RDMA/rxe: MR re-registration swaps the PD before validating access flags, freeing a live PDCVE-2026-98366 · Linux kernel RDMA/rxe rxe_rereg_user_mr() (access-flag validation ordering)High