CVE-2026-23311: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23311 is an improper locking vulnerability in the Linux kernel's perf/core subsystem, specifically in the ctx_sched_in() function. When a pinned perf event fails and attempts to wake up threads in the ring buffer, the code improperly attempts to acquire a wait-queue lock while already holding a perf-context lock, causing a lockdep violation. The vulnerability affects Linux kernel versions 6.15.x through 6.18.16, 6.19.x through 6.19.6, and 7.0-rc1. It was disclosed on March 25, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified under CWE-413 (Improper Resource Locking) and CWE-667 (Improper Locking). During event scheduling in ctx_sched_in(), when a pinned event fails, the code path calls perf_event_wakeup() which attempts to grab event->waitq (a wait-queue lock with spinlock depth 3:3) while already holding cpuctx_lock and ctx->lock (both raw spinlocks at depth 2:2) under an RCU read lock. This invalid lock nesting is detected by the kernel's lockdep validator and can result in a kernel panic or system hang. The fix replaces the direct wait-queue wakeup with deferred irq_work to avoid acquiring the wait-queue lock in an improper context (Red Hat Bugzilla, Red Hat Advisory).

Successful exploitation results in a denial of service — specifically a kernel panic or system hang — due to the lockdep violation triggered in the performance monitoring subsystem. There is no confidentiality or integrity impact; the vulnerability is limited to availability. A local attacker with low privileges can crash or hang the affected system by crafting specific perf events that trigger the invalid lock sequence (Red Hat Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability requires local access with low privileges (e.g., the ability to create perf events) and is not remotely exploitable. The EPSS score is approximately 0.017% (0.000170), indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Red Hat Advisory).

• Logs: Kernel log messages containing [ BUG: Invalid wait context ] or lockdep splat output referencing ctx_sched_in, __perf_event_task_sched_in, or perf_event_wakeup.
• System Behavior: Unexpected kernel panic, system hang, or soft lockup warnings on systems running affected kernel versions (6.15.x–6.18.16, 6.19.x–6.19.6, 7.0-rc1) with perf event usage.
• Process: Processes using the perf_event_open syscall with pinned events that coincide with system instability events.

Update the Linux kernel to version 6.18.17 or later, 6.19.7 or later, or 7.0-rc2 or later, which include the fix that replaces the direct wait-queue wakeup with irq_work in ctx_sched_in(). Patches are available in the upstream stable kernel tree. As a temporary workaround where patching is not immediately possible, restricting unprivileged access to perf_event_open (e.g., via kernel.perf_event_paranoid sysctl set to a restrictive value) can reduce exposure (Red Hat Advisory, Red Hat Bugzilla).