CVE-2026-58089: hwpmc fails to detach PMCs during exec credential transitions
When a process calls execve(2) to execute a setuid or setgid image, hwpmc(4) is supposed to detach PMCs owned by unprivileged processes. An inverted check meant that this scenario was not handled properly.
An unprivileged local user who has attached PMCs to a process can continue monitoring it after the process executes a setuid or setgid binary, contrary to the intended policy.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unprivileged local user who has already attached PMCs to a process can exploit it when that process executes a setuid or setgid binary.
What access or conditions are required for exploitation?
The attacker needs local access and must be able to attach PMCs through hwpmc(4) to the target process before it performs an execve(2) transition to a setuid or setgid image.
What is the security impact?
The attacker can continue monitoring the process with PMCs after it gains privileges through execution of a setuid or setgid binary, bypassing the intended detachment policy.