CVE-2026-97961: perf/core: Allow list_del during perf_event_overflow()
In the Linux kernel, the following vulnerability has been resolved:
perf/core: Allow listdel during perfeventoverflow()
A PMU might use perfschedcbinc() and perfschedcbdec() interface to get the PMU call back function pmu::schedtask invoked at schedule in and schedule out. This is achieved by walking along the list anchored by schedcblist.
The following scenario might lead to a list corruption.
perfpmuschedtask() foreachlistentry(..., &schedcblist) +--> perfpmuschedtask() +--> event->pmu->schedtask()) +--> PMUpushsample() +--> perfeventoverflow() +--> perfeventoverflow() +--> pmu->stop() +--> perfschedcbdec() remove entry from schedcblist while list node in use.
This happens when ioctl(fd, PERFEVENTIOCREFRESH, xxx) has been invoked and perfevent::eventlimit hits zero.
Prevent the list corruption and convert foreachlistentry() to foreachlistentrysafe().
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger the list corruption?
A PMU must use the perf_sched_cb_inc() and perf_sched_cb_dec() callback interface, and its sched_task callback must reach perf_event_overflow(). The problematic path occurs when PERF_EVENT_IOC_REFRESH has been invoked and the event_limit reaches zero, causing pmu->stop() to remove an entry from sched_cb_list while that list is being traversed.
What is the practical effect of the flaw?
The affected scheduling callback list can be corrupted when an entry is removed during traversal. The provided information does not state a confirmed impact beyond list corruption.
How is the issue fixed?
The list traversal in perf_pmu_sched_task() is changed from for_each_list_entry() to for_each_list_entry_safe(), allowing an entry to be removed safely while the list is in use.