CVE-2026-98790: Linux Kernel Race Condition Vulnerability

CVE-2026-98790 is a race condition flaw in the Linux kernel affecting perf_event_exit_task() and perf_pending_task() during exec. This vulnerability can trigger unexpected warnings in system execution paths. This post covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-98790 Overview

CVE-2026-98790 is a race condition in the Linux kernel's performance events (perf) subsystem. The flaw occurs between perf_event_exit_task() and perf_pending_task() during begin_new_exec(). When begin_new_exec() runs, perf_event_exit_task() may execute without the PF_EXITING flag being set on the task. As a result, perf_sigtrap() continues executing and triggers WARN_ON_ONCE(event->ctx->task != current). The upstream fix explicitly checks whether event->ctx->task equals TASK_TOMBSTONE and drops the redundant PF_EXITING check. The issue affects Linux kernel builds that include the perf subsystem on affected branches.

Critical Impact
The race condition can produce kernel warnings and inconsistent state in the perf subsystem during process execution, affecting kernel stability on systems using performance event tracing.

Affected Products

Linux kernel (upstream perf subsystem)
Stable kernel branches referenced by the published fix commits
Distributions that ship affected kernel versions prior to the patched commits

Discovery Timeline

2026-10-18 - CVE-2026-98790 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-98790

Vulnerability Analysis

The vulnerability is a Race Condition [CWE-362] in the Linux kernel perf event subsystem. Two independent code paths — task exit and execve() — can both invoke perf_event_exit_task(). During begin_new_exec(), this function may run before the kernel sets the PF_EXITING flag on the current task. The signal-trap handler perf_sigtrap() relies on PF_EXITING to decide whether to proceed. Because the flag is not set during exec, perf_sigtrap() proceeds and reaches the assertion WARN_ON_ONCE(event->ctx->task != current), which fires because the context has already been detached.

Root Cause

The root cause is reliance on PF_EXITING as a proxy for whether the perf context has been torn down. Both exit and exec paths set ctx->task to TASK_TOMBSTONE when calling perf_event_exit_task(), but only the exit path sets PF_EXITING. This mismatch leaves a window during execve() where perf callbacks execute against a tombstoned context.

Attack Vector

Triggering the race requires local activity that generates perf events on a task undergoing execve(). There is no indication of remote exploitability, and no public proof-of-concept or in-the-wild exploitation has been reported. The practical consequence is a kernel warning and potential state inconsistency in the perf subsystem rather than privilege escalation. The EPSS score is 0.168%.

No verified public exploit code is available. The upstream fix replaces the PF_EXITING check with a direct test for event->ctx->task == TASK_TOMBSTONE. See the kernel.org commit 672b8a9ce8f5 for the patch content.

Detection Methods for CVE-2026-98790

Indicators of Compromise

Kernel log entries containing WARN_ON_ONCE originating from perf_sigtrap() or related perf event teardown code paths.
Unexpected perf subsystem warnings on hosts running workloads that frequently invoke execve() while performance monitoring is active.

Detection Strategies

Review dmesg and /var/log/kern.log for warnings referencing perf_event_exit_task, perf_pending_task, or perf_sigtrap.
Audit installed kernel package versions against distribution advisories tied to the referenced stable commits.
Correlate kernel warning timestamps with process execution events to identify repeatable triggers.

Monitoring Recommendations

Forward kernel ring buffer messages to a centralized log platform for pattern analysis.
Alert on recurring WARN_ON_ONCE events from the kernel/events/core.c subsystem.
Track kernel package versions across the fleet to confirm patch deployment coverage.

How to Mitigate CVE-2026-98790

Immediate Actions Required

Identify Linux hosts running unpatched kernel versions and prioritize those using perf tooling or tracing.
Apply vendor-provided kernel updates that incorporate the upstream fix as soon as they are available.
Reboot patched systems to activate the new kernel image.

Patch Information

The fix is published in multiple stable kernel branches. Reference commits include 524063fea29f, 655acfa713bc, 672b8a9ce8f5, 81e61e3f8bef, and ffb684f2aa14. Consult your distribution's security advisories for backported package versions.

Workarounds

Restrict access to perf_event_open() by setting kernel.perf_event_paranoid to a more restrictive value where operationally feasible.
Limit use of performance monitoring tools on affected hosts until patched kernels are deployed.
Where tracing is non-essential, disable perf-based profiling agents to reduce the window in which the race can trigger.

bash

# Restrict unprivileged access to perf_event_open until patched
sysctl -w kernel.perf_event_paranoid=3
echo 'kernel.perf_event_paranoid=3' >> /etc/sysctl.d/99-perf-hardening.conf