CVE-2026-23271 (GCVE-0-2026-23271)

Vulnerability from cvelistv5 – Published: 2026-03-20 08:08 – Updated: 2026-05-11 22:03
VLAI
Title
perf: Fix __perf_event_overflow() vs perf_remove_from_context() race
Summary
In the Linux kernel, the following vulnerability has been resolved: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race Make sure that __perf_event_overflow() runs with IRQs disabled for all possible callchains. Specifically the software events can end up running it with only preemption disabled. This opens up a race vs perf_event_exit_event() and friends that will go and free various things the overflow path expects to be present, like the BPF program.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 592903cdcbf606a838056bae6d03fc557806c914 , < 4df1a45819e50993cb351682a6ae8e7ed2d233a0 (git)
Affected: 592903cdcbf606a838056bae6d03fc557806c914 , < 4f8d5812337871227bb2c98669a87c306a2f86ef (git)
Affected: 592903cdcbf606a838056bae6d03fc557806c914 , < 5c48fdc4b4623533d86e279f51531a7ba212eb87 (git)
Affected: 592903cdcbf606a838056bae6d03fc557806c914 , < 3f89b61dd504c5b6711de9759e053b082f9abf12 (git)
Affected: 592903cdcbf606a838056bae6d03fc557806c914 , < bb190628fe5f2a73ba762a9972ba16c5e895f73e (git)
Affected: 592903cdcbf606a838056bae6d03fc557806c914 , < c9bc1753b3cc41d0e01fbca7f035258b5f4db0ae (git)
Create a notification for this product.
Linux Linux Affected: 2.6.31
Unaffected: 0 , < 2.6.31 (semver)
Unaffected: 6.1.167 , ≤ 6.1.* (semver)
Unaffected: 6.6.130 , ≤ 6.6.* (semver)
Unaffected: 6.12.77 , ≤ 6.12.* (semver)
Unaffected: 6.18.17 , ≤ 6.18.* (semver)
Unaffected: 6.19.7 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/events/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4df1a45819e50993cb351682a6ae8e7ed2d233a0",
              "status": "affected",
              "version": "592903cdcbf606a838056bae6d03fc557806c914",
              "versionType": "git"
            },
            {
              "lessThan": "4f8d5812337871227bb2c98669a87c306a2f86ef",
              "status": "affected",
              "version": "592903cdcbf606a838056bae6d03fc557806c914",
              "versionType": "git"
            },
            {
              "lessThan": "5c48fdc4b4623533d86e279f51531a7ba212eb87",
              "status": "affected",
              "version": "592903cdcbf606a838056bae6d03fc557806c914",
              "versionType": "git"
            },
            {
              "lessThan": "3f89b61dd504c5b6711de9759e053b082f9abf12",
              "status": "affected",
              "version": "592903cdcbf606a838056bae6d03fc557806c914",
              "versionType": "git"
            },
            {
              "lessThan": "bb190628fe5f2a73ba762a9972ba16c5e895f73e",
              "status": "affected",
              "version": "592903cdcbf606a838056bae6d03fc557806c914",
              "versionType": "git"
            },
            {
              "lessThan": "c9bc1753b3cc41d0e01fbca7f035258b5f4db0ae",
              "status": "affected",
              "version": "592903cdcbf606a838056bae6d03fc557806c914",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/events/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.31"
            },
            {
              "lessThan": "2.6.31",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.167",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.77",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.17",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.167",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.130",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.77",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.17",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.7",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf: Fix __perf_event_overflow() vs perf_remove_from_context() race\n\nMake sure that __perf_event_overflow() runs with IRQs disabled for all\npossible callchains. Specifically the software events can end up running\nit with only preemption disabled.\n\nThis opens up a race vs perf_event_exit_event() and friends that will go\nand free various things the overflow path expects to be present, like\nthe BPF program."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:03:38.124Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4df1a45819e50993cb351682a6ae8e7ed2d233a0"
        },
        {
          "url": "https://git.kernel.org/stable/c/4f8d5812337871227bb2c98669a87c306a2f86ef"
        },
        {
          "url": "https://git.kernel.org/stable/c/5c48fdc4b4623533d86e279f51531a7ba212eb87"
        },
        {
          "url": "https://git.kernel.org/stable/c/3f89b61dd504c5b6711de9759e053b082f9abf12"
        },
        {
          "url": "https://git.kernel.org/stable/c/bb190628fe5f2a73ba762a9972ba16c5e895f73e"
        },
        {
          "url": "https://git.kernel.org/stable/c/c9bc1753b3cc41d0e01fbca7f035258b5f4db0ae"
        }
      ],
      "title": "perf: Fix __perf_event_overflow() vs perf_remove_from_context() race",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23271",
    "datePublished": "2026-03-20T08:08:46.711Z",
    "dateReserved": "2026-01-13T15:37:45.991Z",
    "dateUpdated": "2026-05-11T22:03:38.124Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-23271",
      "date": "2026-05-28",
      "epss": "0.00014",
      "percentile": "0.0274"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-23271\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-03-20T09:16:11.773\",\"lastModified\":\"2026-04-02T15:16:28.190\",\"vulnStatus\":\"Undergoing Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nperf: Fix __perf_event_overflow() vs perf_remove_from_context() race\\n\\nMake sure that __perf_event_overflow() runs with IRQs disabled for all\\npossible callchains. Specifically the software events can end up running\\nit with only preemption disabled.\\n\\nThis opens up a race vs perf_event_exit_event() and friends that will go\\nand free various things the overflow path expects to be present, like\\nthe BPF program.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\nperf: Correcci\u00f3n de la condici\u00f3n de carrera entre __perf_event_overflow() y perf_remove_from_context()\\n\\nAsegurar que __perf_event_overflow() se ejecute con las IRQ deshabilitadas para todas las cadenas de llamadas posibles. Espec\u00edficamente, los eventos de software pueden terminar ejecut\u00e1ndolo con solo la preemption deshabilitada.\\n\\nEsto abre una condici\u00f3n de carrera frente a perf_event_exit_event() y funciones relacionadas que liberar\u00e1n varias cosas que la ruta de desbordamiento espera que est\u00e9n presentes, como el programa BPF.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3f89b61dd504c5b6711de9759e053b082f9abf12\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4df1a45819e50993cb351682a6ae8e7ed2d233a0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4f8d5812337871227bb2c98669a87c306a2f86ef\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5c48fdc4b4623533d86e279f51531a7ba212eb87\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/bb190628fe5f2a73ba762a9972ba16c5e895f73e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c9bc1753b3cc41d0e01fbca7f035258b5f4db0ae\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.