CVE-2026-93817

A flaw was found in the Linux kernel's performance events (perf) subsystem. This vulnerability occurs because memory allocated for event address filters is released prematurely while still in active use by other kernel processes. A local user could exploit this use-after-free flaw during performance monitoring operations to cause a Denial of Service (DoS) through a system crash or potentially corrupt system memory.

This vulnerability is rated as an Important severity flaw because an unprivileged local attacker can exploit premature deallocation of event address filter ranges within the kernel performance monitoring subsystem to compromise system integrity. Although exploitation is constrained to local access, the flaw allows unprivileged users on standard configurations to trigger a use-after-free condition, creating potential paths for arbitrary code execution in kernel space or causing an immediate denial of service via kernel panic. Deployments where unprivileged users cannot execute arbitrary binaries or where access to the perf subsystem is strictly restricted face reduced risk.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Restrict unprivileged access to the perf event subsystem by setting the kernel.perf_event_paranoid sysctl parameter.

1. Apply the setting immediately:

sysctl -w kernel.perf_event_paranoid=3

2. Persist the configuration across system reboots:

echo 'kernel.perf_event_paranoid = 3' > /etc/sysctl.d/99-perf.conf

Caveats: Setting kernel.perf_event_paranoid to 3 disables the use of the perf_event_open() system call for unprivileged users, preventing them from using performance monitoring tools such as perf. Only processes with CAP_SYS_ADMIN or CAP_PERFMON capabilities will be permitted to access performance events.