CVE-2024-43870: perf: Fix event leak upon exit

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-08-21 · updated 2026-06-17
Weakness: CWE-401

Description

In the Linux kernel, the following vulnerability has been resolved: perf: Fix event leak upon exit When a task is scheduled out, pending sigtrap deliveries are deferred to the target task upon resume to userspace via task_work. However failures while adding an event's callback to the task_work engine are ignored. And since the last call for events exit happen after task work is eventually closed, there is a small window during which pending sigtrap can be queued though ignored, leaking the event refcount addition such as in the following scenario: TASK A ----- do_exit() exit_task_work(tsk); <IRQ> perf_event_overflow() event->pending_sigtrap = pending_id; irq_work_queue(&event->pending_irq); </IRQ> =========> PREEMPTION: TASK A -> TASK B event_sched_out() event->pending_sigtrap = 0; atomic_long_inc_not_zero(&event->refcount) // FAILS: task work has exited task_work_add(&event->pending_task) [...] <IRQ WORK> perf_pending_irq() // early return: event->oncpu = -1 </IRQ WORK> [...] =========> TASK B -> TASK A perf_event_exit_task(tsk) perf_event_exit_event() free_event() WARN(atomic_long_cmpxchg(&event->refcount, 1, 0) != 1) // leak event due to unexpected refcount == 2 As a result the event is never released while the task exits. Fix this with appropriate task_work_add()'s error handling.

Affected products

Linux kernel: from 5.15.84 before 5.15.165; from 6.0.14 before 6.1; from 6.1.1 before 6.1.103; from 6.2 before 6.6.44; from 6.7 before 6.10.3; 6.1, 6.1-rc8 — fixed in 5.15.165, 6.1, 6.1.103, 6.10.3, 6.6.44

How to fix

Upgrade to a fixed version: Linux kernel 5.15.165, 6.1, 6.1.103, 6.10.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-43870 or the next vulnerability affects your stack