A race condition in perfeventopen() allows local attackers to leak sensitive data from setuid programs. As no relevant locks (in particular the credguardmutex) are held during the ptracemayaccess() call, it is possible for the specified target task to perform an execve() syscall with setuid execution before perfeventalloc() actually attaches to it, allowing an attacker to bypass the ptracemayaccess() check and the perfeventexittask(current) call that is performed in installexeccreds() during privileged execve() calls.