CVE-2026-23271: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23271 is a race condition vulnerability in the Linux kernel's performance event (perf) subsystem, specifically between __perf_event_overflow() and perf_remove_from_context(). The flaw arises because software perf events can invoke __perf_event_overflow() with only preemption disabled rather than IRQs disabled, creating a window where perf_event_exit_event() may concurrently free resources — such as BPF programs — that the overflow handler expects to still be present. Affected kernel versions span from 2.6.31 through multiple stable branches, with fixes targeting versions before 6.1.167, 6.6.130, 6.12.77, 6.18.17, and 6.19.7. It carries a CVSS v3.1 base score of 7.8 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is improper synchronization (CWE-362 / CWE-367 TOCTOU) in the kernel's perf event overflow handling path. When software perf events trigger __perf_event_overflow(), the function may execute with only preemption disabled rather than with IRQs fully disabled, as required for safe access to shared kernel structures. This creates a time-of-check to time-of-use window: a concurrent call to perf_event_exit_event() or related teardown functions can free resources — most notably attached BPF programs — between the time the overflow handler checks for their presence and the time it dereferences them, resulting in a use-after-free condition. The fix ensures IRQs are disabled across all callchains that invoke __perf_event_overflow() (Red Hat Bugzilla, Red Hat Advisory).

Successful exploitation can lead to kernel memory corruption via use-after-free, potentially enabling a local attacker to execute arbitrary code with kernel privileges, escalate from a low-privileged user to root, or cause a kernel panic resulting in a denial of service. The confidentiality, integrity, and availability impacts are all rated High, as kernel-level code execution grants full control over the affected system, including access to all data in memory and the ability to persist malicious modifications (Red Hat Advisory, Feedly).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time. The vulnerability requires local access and low privileges (permission to use perf events), limiting the attack surface compared to remote vulnerabilities. The EPSS score is approximately 0.018% (0.000180), reflecting a low probability of near-term exploitation. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Red Hat Advisory, Feedly).

Update the Linux kernel to a patched stable version: 6.1.167 or later, 6.6.130 or later, 6.12.77 or later, 6.18.17 or later, or 6.19.7 or later. Patches are available via the upstream kernel stable branches and have been incorporated into distributions including Red Hat, SUSE, Debian, and Amazon Linux 2023. As a temporary workaround where immediate patching is not feasible, restrict access to perf event capabilities using Linux Security Modules (e.g., SELinux, AppArmor) or by setting kernel.perf_event_paranoid to a restrictive value (e.g., 3) via sysctl to limit which users can create performance monitoring events (Red Hat Advisory, Red Hat Bugzilla).