HIGH Introduced in 4.7
perf AddrFilter UAF
CVE-2026-93817
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.9MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: perf: Fix addr_filter_ranges lifetime Lee Jia Jie reported that since event::addr_filter_ranges is used under RCU, it should be RCU freed.
02KernelScan AI Analysis
Risk summary
A use-after-free vulnerability exists in the Linux kernel's perf events subsystem where address filter range data is freed before the RCU grace period completes, allowing a concurrent RCU reader to access freed memory. Any local user who can create and destroy perf events may trigger this race, potentially leading to kernel memory corruption, information disclosure, or a system crash.
Vulnerability analysis
The perf events subsystem stores address filter range data that is read under RCU protection, but the original code freed this data with a plain deallocation in the event teardown path before the RCU grace period elapsed. This means another thread performing an RCU-protected read could still be accessing the filter ranges when the memory is freed, resulting in a use-after-free. The fix moves the deallocation into the RCU callback that runs after the grace period, ensuring all readers have completed before the memory is released. This is reachable from local userspace through the perf events interface; unprivileged users can access perf events for self-monitoring depending on the system's perf_event_paranoid setting, and the race occurs during event destruction.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 4.7 | 6.12.111 | cd8dab11046c |
| 6.18 | 4.7 | 6.18.53 | 6f1853b2b9f3 |
| mainline | 4.7 | 7.2 | e62d4192e593 |
| cip/6.12 | 4.7 | 6.12.111-cip32 | cd8dab11046c |