CVE-2026-23271

Vulnerability

A race condition exists in the Linux kernel's perf subsystem between __perf_event_overflow() and perf_remove_from_context(). The overflow handler can be invoked with only run with preemption disabled for software events, rather than with IRQs fully disabled. This opens a window where perf_event_exit_event() and related functions can free resources (such as BPF programs) that the overflow path expects to still be valid [1].

Exploitation

An attacker with local access and the ability to set up software performance monitoring events can trigger the race. The attack requires precise timing to hit the window where the overflow handler executes concurrently with event teardown. No special privileges beyond those needed to use perf events are required [1].

Impact

Successful exploitation leads to a use-after-free condition, where the kernel accesses freed memory. This can result in a denial of service (system crash) or potentially privilege escalation if the freed memory is reallocated with attacker-controlled data [1].

Mitigation

The fix has been applied to the Linux kernel stable tree. Users should update to a kernel version containing the commit that ensures __perf_event_overflow() always runs with IRQs disabled [1].