CVE-2026-23271

perf: Fix __perf_event_overflow() vs perf_remove_from_context() race

State: Published
Severity: 7.8 High
Published: Mar 20, 2026
Updated: Oct 19, 2026
Reserved: Jan 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

perf: Fix __perf_event_overflow() vs perf_remove_from_context() race

Make sure that __perf_event_overflow() runs with IRQs disabled for all possible callchains. Specifically the software events can end up running it with only preemption disabled.

This opens up a race vs perf_event_exit_event() and friends that will go and free various things the overflow path expects to be present, like the BPF program.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected Products

Product	Versions
LinuxLinux	592903cdcbf606a838056bae6d03fc557806c914 to before 4df1a45819e50993cb351682a6ae8e7ed2d233a0Affected 592903cdcbf606a838056bae6d03fc557806c914 to before 4f8d5812337871227bb2c98669a87c306a2f86efAffected 592903cdcbf606a838056bae6d03fc557806c914 to before 5c48fdc4b4623533d86e279f51531a7ba212eb87Affected 592903cdcbf606a838056bae6d03fc557806c914 to before 3f89b61dd504c5b6711de9759e053b082f9abf12Affected 592903cdcbf606a838056bae6d03fc557806c914 to before bb190628fe5f2a73ba762a9972ba16c5e895f73eAffected 592903cdcbf606a838056bae6d03fc557806c914 to before c9bc1753b3cc41d0e01fbca7f035258b5f4db0aeAffected
LinuxLinux	2.6.31Affected before 2.6.31Not affected 6.1.167 through 6.1.Not affected 6.6.130 through 6.6.Not affected 6.12.77 through 6.12.Not affected 6.18.17 through 6.18.Not affected 6.19.7 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

592903cdcbf606a838056bae6d03fc557806c914 to before 4df1a45819e50993cb351682a6ae8e7ed2d233a0Affected
592903cdcbf606a838056bae6d03fc557806c914 to before 4f8d5812337871227bb2c98669a87c306a2f86efAffected
592903cdcbf606a838056bae6d03fc557806c914 to before 5c48fdc4b4623533d86e279f51531a7ba212eb87Affected
592903cdcbf606a838056bae6d03fc557806c914 to before 3f89b61dd504c5b6711de9759e053b082f9abf12Affected
592903cdcbf606a838056bae6d03fc557806c914 to before bb190628fe5f2a73ba762a9972ba16c5e895f73eAffected
592903cdcbf606a838056bae6d03fc557806c914 to before c9bc1753b3cc41d0e01fbca7f035258b5f4db0aeAffected

LinuxLinux

2.6.31Affected
before 2.6.31Not affected
6.1.167 through 6.1.*Not affected
6.6.130 through 6.6.*Not affected
6.12.77 through 6.12.*Not affected
6.18.17 through 6.18.*Not affected
6.19.7 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.