CVE-2026-98790: perf: Fix race between perf_event_exit_task() and perf_pending_task()
In the Linux kernel, the following vulnerability has been resolved:
perf: Fix race between perfeventexittask() and perfpendingtask()
A race condition exists between perfeventexittask() and perfpendingtask() during beginnewexec().
During beginnewexec(), perfeventexittask() may be called, and the PFEXITING flag is not set on task. So perfsigtrap() continues to execute and triggers WARNONONCE(event->ctx->task != current).
Since both task exit and exec paths can call perfeventexittask() which sets ctx->task to TASKTOMBSTONE, fix this by explicitly checking if event->ctx->task equals TASKTOMBSTONE and dropping the redundant PFEXITING check.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.113-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.10-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.224 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.113 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.56 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.10 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
azurelinux/kernelto a version that resolves this vulnerability.Fixed in 6.6.161.1-1
Event History
Frequently Asked Questions
What conditions are needed to trigger the race?
The race occurs during begin_new_exec() when perf_event_exit_task() runs while perf_pending_task() continues into perf_sigtrap(). The task does not have PF_EXITING set in this exec path, allowing the warning condition to be reached.
What is the observable effect of the issue?
The race can trigger WARN_ON_ONCE(event->ctx->task != current) in perf_sigtrap(). The affected event context may already have its task pointer set to TASK_TOMBSTONE by perf_event_exit_task().
How does the fix prevent the warning?
The fix explicitly checks whether event->ctx->task is TASK_TOMBSTONE and drops the redundant PF_EXITING check. This handles contexts that have already been detached by the task-exit or exec path.