CVE-2026-64556

CVE-2026-64556 exposes a flaw in the kernel perf event subsystem's handling of the remove_on_exec flag when events belong to groups. When a group leader is marked for removal on exec but its siblings are not, the kernel enters a corrupted state: surviving siblings become detached from the PMU context while remaining linked to a leader that is simultaneously exiting. The DEBUG_LIST sanity check caught this as list corruption (double-adding to active_list during merge_sched_in), but the underlying state machine failure was latent in the remove_on_exec path for years. The fix detaches group relationships when remove_on_exec triggers — siblings are unlinked from their leader rather than being left in an undefined transitional state. This resolves the immediate corruption but does not answer a harder question: what is the intended semantic model for perf event groups? If groups are meant to be coherent units, the API should enforce uniform remove_on_exec behavior across all members. If mixed-membership survival is legitimate, the state machine needs explicit handling for siblings outliving their leader. The current code sits between these models, clarified for this one path but not formally defined. For defenders: this bug manifests in kernel versions where remove_on_exec interacts with perf event groups. The trigger conditions require precise timing of exec while a group leader is marked for removal but siblings persist. If your systems run perf_event-based tracing tools (common for performance analysis), check whether any custom perf event consumers use groups with heterogeneous remove_on_exec settings. The CVSS of 7.8 reflects serious corruption potential, but the exploitability depends on hitting the specific event lifecycle sequence — the DEBUG_LIST catch was opt-in, meaning this likely ran undetected in production for years.

Reviewed through automated stages and approved by a human before publication.