Inconsistent Event Group State in Linux Kernel Products by Linux Foundation

CVE-2026-64556

What is CVE-2026-64556?

A newly identified vulnerability in the Linux kernel allows event groups to maintain an inconsistent state following the detachment of event groups during process execution termination. The function responsible for removing events, perf_event_remove_on_exec(), fails to adequately detach sibling events from their group leader when that leader is removed. This oversight can lead to a scenario where surviving sibling events remain linked to a non-existent group leader, resulting in corruption of the performance monitoring unit (PMU) context. The issue is especially problematic when a later close operation promotes these stale sibling events into an active state without a valid leader, ultimately affecting overall system performance and stability. The bug has been addressed to ensure that relationships between events are properly managed during their removal process, enhancing the robustness of the kernel's handling of event groups.

References