CVE-2024-43870perf: Fix event leak upon exit
- 5.5MediumCVSS base score
- 0.21%Exploitation in 30 daysEPSS · top 88% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: perf: Fix event leak upon exit When a task is scheduled out, pending sigtrap deliveries are deferred to the target task upon resume to userspace via task_work. However failures while adding an event's callback to the task_work engine are ignored. And since the last call for events exit happen after task work is eventually closed, there is a small window during which pending sigtrap can be queued though ignored, leaking the event refcount addition such as in the following scenario: TASK A ----- do_exit() exit_task_work(tsk); <IRQ> perf_event_overflow() event->pending_sigtrap = pending_id; irq_work_queue(&event->pending_irq); </IRQ> =========> PREEMPTION: TASK A -> TASK B event_sched_out() event->pending_sigtrap = 0; atomic_long_inc_not_zero(&event->refcount) // FAILS: task work has exited task_work_add(&event->pending_task) [...] <IRQ WORK> perf_pending_irq() // early return: event->oncpu = -1 </IRQ WORK> [...] =========> TASK B -> TASK A perf_event_exit_task(tsk) perf_event_exit_event() free_event() WARN(atomic_long_cmpxchg(&event->refcount, 1, 0) != 1) // leak event due to unexpected refcount == 2 As a result the event is never released while the task exits. Fix this with appropriate task_work_add()'s error handling.
Timeline
ID reserved
By Linux
- 4 days later
· 4 days later
Published
- 21 months later
· 21 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.1 | Medium5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.21% · top 88% of all CVEs (13 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.5.
Affected products
- affected 8bffa95ac19ff27c8261904f89d36c7fcf215d59 – < 67fad724f1b568b356c1065d50df46e6b30eb2f7
- affected 517e6a301f34613bff24a8e35b5455884f2d83d8 – < 70882d7fa74f0731492a0d493e8515a4f7131831
- affected 517e6a301f34613bff24a8e35b5455884f2d83d8 – < 05d3fd599594abf79aad4484bccb2b26e1cb0b51
- affected 517e6a301f34613bff24a8e35b5455884f2d83d8 – < 3d7a63352a93bdb8a1cdf29606bf617d3ac1c22a
- affected 517e6a301f34613bff24a8e35b5455884f2d83d8 – < 2fd5ad3f310de22836cdacae919dd99d758a1f1b
- affected 78e1317a174edbfd1182599bf76c092a2877672c
- affected 5.15.84 – < 5.15.165
- affected 6.0.14 – < 6.1
- affected 6.1
- unaffected < 6.1
- unaffected 5.15.165 – ≤ 5.15.*
- unaffected 6.1.103 – ≤ 6.1.*
- unaffected 6.6.44 – ≤ 6.6.*
- unaffected 6.10.3 – ≤ 6.10.*
- unaffected 6.11 – ≤ *
References
References6
- https://git.kernel.org/stable/c/67fad724f1b568b356c1065d50df46e6b30eb2f7 (opens in a new tab)
- https://git.kernel.org/stable/c/70882d7fa74f0731492a0d493e8515a4f7131831 (opens in a new tab)
- https://git.kernel.org/stable/c/05d3fd599594abf79aad4484bccb2b26e1cb0b51 (opens in a new tab)
- https://git.kernel.org/stable/c/3d7a63352a93bdb8a1cdf29606bf617d3ac1c22a (opens in a new tab)
- https://git.kernel.org/stable/c/2fd5ad3f310de22836cdacae919dd99d758a1f1b (opens in a new tab)
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2024-40520 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2024-43870)Record last updated .