perf: Fix race between perf_event_exit_task() and perf_pending_task() (Linux Linux)

CVE-2026-98790
Not available

At a glance

Source
NVD
EPSS
EPSS 0.17 % · percentile 7 ()
State
PUBLISHED
Published
Updated
Assigner
Linux
NVD status
Received

Description

In the Linux kernel, the following vulnerability has been resolved: perf: Fix race between perf_event_exit_task() and perf_pending_task() A race condition exists between perf_event_exit_task() and perf_pending_task() during begin_new_exec(). During begin_new_exec(), perf_event_exit_task() may be called, and the PF_EXITING flag is not set on task. So perf_sigtrap() continues to execute and triggers WARN_ON_ONCE(event->ctx->task != current). Since both task exit and exec paths can call perf_event_exit_task() which sets ctx->task to TASK_TOMBSTONE, fix this by explicitly checking if event->ctx->task equals TASK_TOMBSTONE and dropping the redundant PF_EXITING check.

References

European references

CERT-FR advisories

Affected products

ProductVersions
Linux · Linuxaffected 97ba62b278674293762c3d91f724f1bb922f04e0 < 6e454fbe3e646d119ab75e907035950e0e857c09 ; affected 97ba62b278674293762c3d91f724f1bb922f04e0 < a8a6fe5601fa2d2c0fbfb3e531a1063f73c1eae3 ; affected 97ba62b278674293762c3d91f724f1bb922f04e0 < 655acfa713bce9ae9c81a654459890c2f58cb4e8 ; affected 97ba62b278674293762c3d91f724f1bb922f04e0 < 672b8a9ce8f51b991481dfde26fba5cc4340a91a ; affected 97ba62b278674293762c3d91f724f1bb922f04e0 < 524063fea29f8a841e49927ea7a8085194ad3ec2 ; affected 97ba62b278674293762c3d91f724f1bb922f04e0 < 81e61e3f8befa1bae3ec8e779d8ada5e5e362c21
Linux · Linuxaffected 5.13 ; unaffected 0 < 5.13 ; unaffected 5.15.224 ≤ 5.15.* ; unaffected 6.1.191 ≤ 6.1.* ; unaffected 6.6.160 ≤ 6.6.* ; unaffected 6.12.113 ≤ 6.12.*

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD