{"id":"CVE-2026-64556","title":"perf/core: Detach event groups during remove_on_exec","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nperf/core: Detach event groups during remove_on_exec\n\nperf_event_remove_on_exec() removes events by calling\nperf_event_exit_event(). For top-level events, this removes …","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 2e498d0a74e5b88a6689ae1b811f247f91ff188e < 4cdb1b3ab96eb1b7eb70bc5c82fede334bd60df2","Linux >= 2e498d0a74e5b88a6689ae1b811f247f91ff188e < 39358e856fb89e62e3c8d7389a2dc4ec33dbe90e","Linux >= 2e498d0a74e5b88a6689ae1b811f247f91ff188e < a2d5d3ee7b6e3953114726b1521e62123ab5b043","Linux >= 2e498d0a74e5b88a6689ae1b811f247f91ff188e < 06ccef0434e98058ddae7bcebc901f93d22b7653","Linux >= 2e498d0a74e5b88a6689ae1b811f247f91ff188e < 037a3c43edfb597665dd34457cd22b14692f2ba3","Linux 5.13"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T15:42:33.956439Z"},"published":"2026-07-29","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:52:52.422Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-64556","references":[{"url":"https://git.kernel.org/stable/c/4cdb1b3ab96eb1b7eb70bc5c82fede334bd60df2"},{"url":"https://git.kernel.org/stable/c/39358e856fb89e62e3c8d7389a2dc4ec33dbe90e"},{"url":"https://git.kernel.org/stable/c/a2d5d3ee7b6e3953114726b1521e62123ab5b043"},{"url":"https://git.kernel.org/stable/c/06ccef0434e98058ddae7bcebc901f93d22b7653"},{"url":"https://git.kernel.org/stable/c/037a3c43edfb597665dd34457cd22b14692f2ba3"}],"tags":["cve.org"],"epss":0.00124,"epssPercentile":0.01942,"ingestedAt":"2026-10-16T17:24:46.834Z","slug":"CVE-2026-64556","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nperf/core: Detach event groups during remove_on_exec\n\nperf_event_remove_on_exec() removes events by calling\nperf_event_exit_event(). For top-level events, this removes the event from\nthe context with DETACH_EXIT only.\n\nThis can leave inconsistent group state when a removed event is a group\nleader and the group contains siblings without remove_on_exec. If the group\nwas active, the surviving siblings can remain active and attached to the\nremoved leader's sibling list, but are no longer represented by a valid\ngroup leader on the PMU context active lists.\n\nA later close of the removed leader uses DETACH_GROUP and can promote the\nstill-active siblings from this stale group state. The next schedule-in can\nthen add an already-linked active_list entry again, corrupting the PMU\ncontext active list.\n\nWith DEBUG_LIST enabled, this is caught as a list_add double-add in\nmerge_sched_in().\n\nFix this by detaching group relationships when remove_on_exec removes an\nevent. This preserves the existing task-exit and revoke behavior, while\nensuring surviving siblings are ungrouped before the removed event leaves\nthe context.\n\n## Affected\n\n- `Linux >= 2e498d0a74e5b88a6689ae1b811f247f91ff188e < 4cdb1b3ab96eb1b7eb70bc5c82fede334bd60df2`\n- `Linux >= 2e498d0a74e5b88a6689ae1b811f247f91ff188e < 39358e856fb89e62e3c8d7389a2dc4ec33dbe90e`\n- `Linux >= 2e498d0a74e5b88a6689ae1b811f247f91ff188e < a2d5d3ee7b6e3953114726b1521e62123ab5b043`\n- `Linux >= 2e498d0a74e5b88a6689ae1b811f247f91ff188e < 06ccef0434e98058ddae7bcebc901f93d22b7653`\n- `Linux >= 2e498d0a74e5b88a6689ae1b811f247f91ff188e < 037a3c43edfb597665dd34457cd22b14692f2ba3`\n- `Linux 5.13`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}