Look up another CVE · open CVE-2026-64556 in the interactive tracker
CVE-2026-64556
perf/core: Detach event groups during remove_on_exec
Published 2026-07-29 (3 months ago) by the Linux kernel CNA. Subsystem kernel/events. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-64556 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | vulnerable | 6.1.190-1 | No fix published anywhere yet, neither in Debian nor upstream for the series bookworm tracks. Watch the Debian tracker page for this CVE. Advisories for bookworm have historically landed a median of 23 days after publication. |
| Debian 13trixie | fixed | 6.12.96-1 | Update the kernel and reboot. Fixed in 6.12.96-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.4-1 | Update the kernel and reboot. Fixed in 7.1.4-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.4-1 | Update the kernel and reboot. Fixed in 7.1.4-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4724-1 · 2026-08-07 · text | 6.12.100-1~deb12u1 | Update the kernel and reboot. DLA-4724-1 shipped the fix on 2026-08-07, in 6.12.100-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
perf_event_remove_on_exec() removes events by calling perf_event_exit_event(). For top-level events, this removes the event from the context with DETACH_EXIT only. This can leave inconsistent group state when a removed event is a group leader and the group contains siblings without remove_on_exec. If the group was active, the surviving siblings can remain active and attached to the removed leader's sibling list, but are no longer represented by a valid group leader on the PMU context active lists. A later close of the removed leader uses DETACH_GROUP and can promote the still-active siblings from this stale group state. The next schedule-in can then add an already-linked active_list entry again, corrupting the PMU context active list. With DEBUG_LIST enabled, this is caught as a list_add double-add in merge_sched_in(). Fix this by detaching group relationships when remove_on_exec removes an event. This preserves the existing task-exit and revoke behavior, while ensuring surviving siblings are ungrouped before the removed event leaves the context.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
kernel/events/core.c
- What this is
- PERFORMANCE EVENTS SUBSYSTEMMAINTAINERS section matched on kernel/events/* · linux-perf-users@vger.kernel.org · Supported
Check it on the machine
grep -w CONFIG_PERF_EVENTS /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian builds this code. Every release below compiles the affected file into the kernels it ships.
- bookworm, trixie, forky, sid, bookworm · linux-6.12y
- y
- built into the kernel image on every flavour - only a patch removes it
- Build switch
- CONFIG_PERF_EVENTS
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-07-29 (3 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.12%, higher than 1.9% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- kernel/events
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 5.13 | 6.6.145 | 4cdb1b3ab96e |
| 5.13 | 6.12.96 | 39358e856fb8 |
| 5.13 | 6.18.39 | a2d5d3ee7b6e |
| 5.13 | 7.1.4 | 06ccef0434e9 |
| 5.13 | 7.2 | 037a3c43edfb |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4724-1 | 2026-08-07 | bookworm 6.12.100-1~deb12u1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The vulnerability is triggered entirely through local syscalls — `perf_event_open(2)` to build the event group and `execve(2)`/`close(2)` to trigger the stale-group corruption. No network or physical vector is involved.
- AC:LAttack complexity, low
- The attacker controls the entire deterministic sequence: create a pinned/enabled group with a `remove_on_exec` leader plus non-`remove_on_exec` siblings, exec, then close the leader. No race the attacker cannot influence is required.
- PR:LPrivileges required, low
- An unprivileged user can open perf events on their own task with `exclude_kernel=1` even at the default `perf_event_paranoid=2`, requiring no capability. Basic local user access suffices.
- UI:NUser interaction, none
- The attacking process performs every step itself (open, exec, close); no action from any other user is needed.
- S:UScope, unchanged
- The corruption stays within the kernel's own security authority (PMU context list in kernel heap); it does not cross a hypervisor/IOMMU/sandbox boundary.
- C:HConfidentiality impact, high
- Corrupting the doubly-linked active list of `perf_event` objects yields pointer manipulation over heap-embedded list nodes, which can be leveraged to read adjacent/freed kernel memory for information disclosure.
- I:HIntegrity impact, high
- A double `list_add`/subsequent list operations on a corrupted list provide write-what-where-style primitives against attacker-influenceable heap objects, enabling arbitrary modification and control-flow hijack.
- A:HAvailability impact, high
- The list corruption reliably produces a kernel crash/oops (caught as a list_add double-add under DEBUG_LIST, silent corruption and panic otherwise), causing denial of service.