CVE-2024-43869

In the Linux kernel, the following vulnerability has been resolved: perf: Fix event leak upon exec and file release The perf pending task work is never waited upon the matching event release. In the case of a child event, released via free_event() directly, this can potentially result in a leaked event, such as in the following scenario that doesn't even require a weak IRQ work implementation to trigger: schedule() prepare_task_switch() =======> <NMI> perf_event_overflow() event->pending_sigtrap = ... irq_work_queue(&event->pending_irq) <======= </NMI> perf_event_task_sched_out() event_sched_out() event->pending_sigtrap = 0; atomic_long_inc_not_zero(&event->refcount) task_work_add(&event->pending_task) finish_lock_switch() =======> <IRQ> perf_pending_irq() //do nothing, rely on pending task work <======= </IRQ> begin_new_exec() perf_event_exit_task() perf_event_exit_event() // If is child event free_event() WARN(atomic_long_cmpxchg(&event->refcount, 1, 0) != 1) // event is leaked Similar scenarios can also happen with perf_event_remove_on_exec() or simply against concurrent perf_event_release(). Fix this with synchonizing against the possibly remaining pending task work while freeing the event, just like is done with remaining pending IRQ work. This means that the pending task callback neither need nor should hold a reference to the event, preventing it from ever beeing freed.

• CWE-401

• https://git.kernel.org/stable/c/104e258a004037bc7dba9f6085c71dad6af57ad4Patch
• https://git.kernel.org/stable/c/3a5465418f5fd970e86a86c7f4075be262682840Patch
• https://git.kernel.org/stable/c/9ad46f1fef421d43cdab3a7d1744b2f43b54dae0Patch
• https://git.kernel.org/stable/c/ed2c202dac55423a52d7e2290f2888bf08b8ee99Patch
• https://git.kernel.org/stable/c/f34d8307a73a18de5320fcc6f40403146d061891Patch
• https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html

Published

Aug 21, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-43863In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-43864In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-43865In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-43866In the Linux kernel, the following vulnerability has been re…4.7
• CVE-2024-43867In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-43868In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-4387Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2024-43870In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-43871In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-43872In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-43873In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2024-43874In the Linux kernel, the following vulnerability has been re…5.5