CVE-2026-23311: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23311 is an improper locking vulnerability in the Linux kernel's perf/core subsystem, specifically in the ctx_sched_in() function. When a pinned perf event fails and attempts to wake up threads in the ring buffer, the code improperly attempts to acquire a wait-queue lock while already holding a perf-context lock, causing a lockdep violation. The vulnerability affects Linux kernel versions 6.15.x through 6.18.16, 6.19.x through 6.19.6, and 7.0-rc1. It was disclosed on March 25, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified under CWE-413 (Improper Resource Locking) and CWE-667 (Improper Locking). During event scheduling in ctx_sched_in(), when a pinned event fails, the code path calls perf_event_wakeup() which attempts to grab event->waitq (a wait-queue lock with spinlock depth 3:3) while already holding cpuctx_lock and ctx->lock (both raw spinlocks at depth 2:2) under an RCU read lock. This invalid lock nesting is detected by the kernel's lockdep validator and can result in a kernel panic or system hang. The fix replaces the direct wait-queue wakeup with deferred irq_work to avoid acquiring the wait-queue lock in an improper context (Red Hat Bugzilla, Red Hat Advisory).

Successful exploitation results in a denial of service — specifically a kernel panic or system hang — due to the lockdep violation triggered in the performance monitoring subsystem. There is no confidentiality or integrity impact; the vulnerability is limited to availability. A local attacker with low privileges can crash or hang the affected system by crafting specific perf events that trigger the invalid lock sequence (Red Hat Advisory).

• Logs: Kernel log messages containing [ BUG: Invalid wait context ] or lockdep splat output referencing ctx_sched_in, __perf_event_task_sched_in, or perf_event_wakeup.
• System Behavior: Unexpected kernel panic, system hang, or soft lockup warnings on systems running affected kernel versions (6.15.x–6.18.16, 6.19.x–6.19.6, 7.0-rc1) with perf event usage.
• Process: Processes using the perf_event_open syscall with pinned events that coincide with system instability events.

Update the Linux kernel to version 6.18.17 or later, 6.19.7 or later, or 7.0-rc2 or later, which include the fix that replaces the direct wait-queue wakeup with irq_work in ctx_sched_in(). Patches are available in the upstream stable kernel tree. As a temporary workaround where patching is not immediately possible, restricting unprivileged access to perf_event_open (e.g., via kernel.perf_event_paranoid sysctl set to a restrictive value) can reduce exposure (Red Hat Advisory, Red Hat Bugzilla).