CVE-2026-23014

Vulnerability

CVE-2026-23014 is a use-after-free vulnerability in the Linux kernel's perf subsystem, specifically in the software event (swevent) hrtimer handling. The root cause is that perf_swevent_cancel_hrtimer() uses hrtimer_try_to_cancel(), which may not fully stop the hrtimer if it is already running. Consequently, the hrtimer can still be active when the associated perf event is freed, leading to a use-after-free condition [1].

Exploitation

To exploit this vulnerability, an attacker must be able to create and destroy perf events, typically requiring local access and the ability to invoke the perf_event_open system call. The attack surface is local, and no special privileges are needed beyond the ability to interact with the perf subsystem. The bug occurs during event destruction, making it a race condition that could be triggered by concurrent operations [2].

Impact

A successful exploit could allow an attacker with local access to escalate privileges or cause a denial of service (system crash) by corrupting kernel memory. The vulnerability is rated High with a CVSS score of 7.8, indicating significant impact on confidentiality, integrity, and availability.

Mitigation

The fix is implemented in the Linux kernel by adding a perf_event::destroy handler that performs a full hrtimer_cancel() to ensure the timer is completely stopped before the event is freed. Patched versions are available in stable kernel updates. Users should apply the latest kernel patches from their distribution.