CVE-2026-23271

A flaw was found in the Linux kernel's perf subsystem. A race condition exists between the __perf_event_overflow() function and functions like perf_remove_from_context() or perf_event_exit_event(). This occurs because __perf_event_overflow() may execute with only preemption disabled, allowing other operations to free resources, such as BPF (Berkeley Packet Filter) programs, that the overflow path expects to be available. This could lead to system instability or a denial of service.

A race exists in the perf software event overflow handling where __perf_event_overflow can run without IRQs disabled for some callchains. This allows perf_event_release_kernel and perf_remove_from_context to free objects that the overflow path still expects to be present such as an attached BPF program. This is a classic lifetime bug and can result in use after free behavior which may manifest as a kernel crash. The issue is not network reachable and it requires local execution that can trigger perf overflow paths such as software events tracepoints or timer based sampling. Impact is denial of service. A conservative worst case includes limited confidentiality and integrity impact due to the use after free class but reliable privilege escalation is not demonstrated by the patch context.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.