CVE-2026-64556: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-64556 is a Linux kernel vulnerability in the perf/core subsystem where perf_event_remove_on_exec() fails to properly detach event groups when removing events during exec operations. Affected are Linux kernel versions from 5.13 up to (but not including) the fixed releases: 6.6.145, 6.12.96, 6.18.39, 7.1.4, and 7.2-rc2. The vulnerability was published on July 29, 2026, with patches available on the same date. It carries a CVSS v3.1 base score of 7.0 (High) (GitHub Advisory, Red Hat).

The root cause is classified as CWE-663 (Use of a Non-reentrant Function in a Concurrent Context), with an associated CAPEC-29 pattern (TOCTOU Race Conditions). When perf_event_remove_on_exec() removes a group leader event using DETACH_EXIT only, surviving sibling events without remove_on_exec remain active and linked to the removed leader's sibling list, but are no longer represented by a valid group leader on the PMU context active lists. A subsequent close of the removed leader triggers DETACH_GROUP, promoting these stale siblings; the next schedule-in then attempts to add an already-linked active_list entry, corrupting the PMU context active list — detectable with DEBUG_LIST as a list_add double-add in merge_sched_in(). The fix ensures group relationships are detached when remove_on_exec removes an event, ungrouping surviving siblings before the removed event leaves the context (GitHub Advisory, Red Hat Bugzilla).

A local user with permission to use performance monitoring events (perf) can trigger PMU context active list corruption, potentially causing kernel crashes (denial of service) or memory corruption. The high confidentiality, integrity, and availability impact ratings reflect that successful exploitation could destabilize or crash the affected system. Lateral movement potential is limited given the local attack vector, but kernel memory corruption could theoretically be leveraged for privilege escalation in more complex exploit chains (GitHub Advisory, Red Hat).

Update to a patched Linux kernel version: 6.6.145, 6.12.96, 6.18.39, 7.1.4, or 7.2-rc2 (or later). The corresponding upstream fix commits are 4cdb1b3ab96e (for one stable branch), 39358e856fb8, a2d5d3ee7b6e, 06ccef0434e9, and 037a3c43edfb. As a short-term workaround, restricting unprivileged access to perf events (e.g., setting kernel.perf_event_paranoid to a restrictive value via sysctl) can reduce exposure until patching is feasible (GitHub Advisory, Red Hat Bugzilla).