CVE-2026-64556: Linux Kernel Privilege Escalation Flaw

CVE-2026-64556 Overview

CVE-2026-64556 is a Linux kernel vulnerability in the perf/core subsystem. The flaw resides in perf_event_remove_on_exec(), which removes performance events by calling perf_event_exit_event(). When a removed event is a group leader and its siblings do not have remove_on_exec set, the kernel leaves the group in an inconsistent state. A later close of the removed leader can promote still-active siblings from this stale state, corrupting the Performance Monitoring Unit (PMU) context active list. The issue affects local, low-privileged users on Linux systems that expose the perf subsystem.

Critical Impact
A local low-privileged attacker can corrupt PMU context active lists in the Linux kernel, leading to kernel memory corruption with high confidentiality, integrity, and availability impact.

Affected Products

Linux kernel builds containing perf_event_remove_on_exec() prior to the referenced upstream fixes
Distributions shipping affected stable kernel branches
Systems exposing the perf_event_open syscall to unprivileged users

Discovery Timeline

2026-07-29 - CVE-2026-64556 published to the National Vulnerability Database
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64556

Vulnerability Analysis

The vulnerability originates in the Linux kernel perf/core event lifecycle. perf_event_remove_on_exec() handles automatic cleanup of performance events tagged with the remove_on_exec attribute when a task calls execve(). For top-level events, the removal path invokes perf_event_exit_event() with DETACH_EXIT only, which detaches the event from the context but does not detach the group relationship.

When the removed event is a group leader and one or more sibling events lack remove_on_exec, the siblings remain attached to the leader's sibling list. If the group was active at the time of removal, those siblings continue to appear active while the leader is no longer represented on the PMU context active lists. This produces an inconsistent group state that survives the exec transition.

A subsequent close of the removed leader takes the DETACH_GROUP path. That path can promote the still-active siblings out of the now-stale group. The next schedule-in operation then re-links an active_list entry that is already linked, corrupting the doubly linked list. Kernels built with CONFIG_DEBUG_LIST catch this as a list_add double-add inside merge_sched_in().

Root Cause

The root cause is incomplete state handling during remove_on_exec cleanup. perf_event_exit_event() detaches the leader from its context without ungrouping siblings, leaving them referenced by a leader that is no longer valid on the PMU active lists. This is a state machine bug in event group teardown rather than a direct memory safety flaw, but it converts into list corruption at the next scheduling event.

Attack Vector

Exploitation requires local access and the ability to create perf events via perf_event_open(). An attacker constructs an event group with a leader that has remove_on_exec set and siblings that do not. The attacker activates the group, triggers execve(), and then closes the leader descriptor. Subsequent scheduling of the surviving siblings corrupts kernel list structures, providing a foothold for further kernel exploitation such as privilege escalation. No user interaction beyond the attacker's own process is required.

The upstream fix detaches group relationships when remove_on_exec removes an event, ensuring surviving siblings are ungrouped before the removed leader leaves the context. Refer to the Kernel Git Commit 037a3c43 and related backports for the patch content.

Detection Methods for CVE-2026-64556

Indicators of Compromise

Kernel log entries reporting list_add double add warnings originating from merge_sched_in() or nearby perf/core functions
Unexpected kernel oops or panic traces referencing perf_event_exit_event, perf_event_remove_on_exec, or PMU scheduling paths
Processes invoking perf_event_open() with remove_on_exec attributes followed by execve() and rapid descriptor closes from unprivileged users

Detection Strategies

Enable CONFIG_DEBUG_LIST on test kernels to surface the double-add condition as an explicit warning
Audit perf_event_open() syscall usage with auditd or eBPF probes to identify unprivileged callers constructing mixed remove_on_exec event groups
Correlate kernel warning messages with process execution telemetry to identify exploitation attempts targeting the perf subsystem

Monitoring Recommendations

Collect and centralize kernel ring buffer output (dmesg, journalctl -k) for pattern matching against perf/core fault signatures
Track the value of kernel.perf_event_paranoid across the fleet; values below 2 broaden the local attack surface
Monitor for repeated process crashes or kernel taint state changes on multi-tenant hosts and container nodes

How to Mitigate CVE-2026-64556

Immediate Actions Required

Apply the upstream kernel patches referenced in the stable tree commits and reboot affected systems
Restrict perf_event_open() to privileged users by setting kernel.perf_event_paranoid=3 where supported
Prioritize patching multi-tenant hosts, container hosts, and systems where untrusted local users execute code

Patch Information

The fix detaches group relationships during remove_on_exec so that surviving siblings are ungrouped before the leader is removed. Backports are available across stable branches via Kernel Git Commit 037a3c43, Kernel Git Commit 06ccef04, Kernel Git Commit 39358e85, Kernel Git Commit 4cdb1b3a, and Kernel Git Commit a2d5d3ee. Consume vendor kernel updates from your distribution as soon as they publish backports.

Workarounds

Set kernel.perf_event_paranoid=3 via sysctl to prevent unprivileged users from calling perf_event_open()
Remove CAP_PERFMON and CAP_SYS_ADMIN from unnecessary users, containers, and service accounts
Deny the perf_event_open syscall in seccomp profiles used by container runtimes where perf access is not required

bash

# Restrict perf_event_open to privileged users until patched kernels are deployed
echo 'kernel.perf_event_paranoid = 3' | sudo tee /etc/sysctl.d/99-cve-2026-64556.conf
sudo sysctl --system

# Verify the runtime value
sysctl kernel.perf_event_paranoid