Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
In the Linux kernel, the following vulnerability has been resolved: perf/core: Detach event groups during remove_on_exec perf_event_remove_on_exec() removes events by calling perf_event_exit_event(). For top-level events, this removes the event from the context with DETACH_EXIT only. This can leave inconsistent group state when a removed event is a group leader and the group contains siblings without remove_on_exec. If the group was active, the surviving siblings can remain active and attached to the removed leader's sibling list, but are no longer represented by a valid group leader on the PMU context active lists. A later close of the removed leader uses DETACH_GROUP and can promote the still-active siblings from this stale group state. The next schedule-in can then add an already-linked active_list entry again, corrupting the PMU context active list. With DEBUG_LIST enabled, this is caught as a list_add double-add in merge_sched_in(). Fix this by detaching group relationships when remove_on_exec removes an event. This preserves the existing task-exit and revoke behavior, while ensuring surviving siblings are ungrouped before the removed event leaves the context.
Priority
MEDIUM
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-07-29 | 1 | General1 |
| 2026-08-16 | 1 | Patch1 |
| 2026-08-27 | 1 | PoC1 |
| 2026-08-28 | 1 | PoC1 |
@spendergrsec It is a patch for CVE-2026-64556's patch. So you know the exploitability :D They really should use better model for patch analysis. (The current one says the patch is correct)
Post summary
The tweet references a patch for CVE‑2026‑64556, confirming its validity, but mentions no exploit details or evidence of active attacks.
🔴 Linux kernel'deki CVE-2026-64556 için PoC/exploit yayınlandı! Açık daha önce yamalanmıştı. Bu açık, perf/core bileşenindeki event group yönetim hatasından kaynaklanıyor ve belirli koşullarda PMU context active list'inin bozulmasına yol açabiliyor. Başarılı istismar kernel crash/DoS ile sonuçlanabilir. PoC/exploit: https://github.com/google/security-research/tree/d9fa91ad8392ead13cbc53fb44a56b187dd88cb9/pocs/linux/kernelctf/CVE-2026-64556_lts/exploit/lts-6.12.91
Post summary
A proof‑of‑concept exploit for CVE‑2026‑64556 on the Linux kernel has been released, detailing an event‑group management fault that can crash the system; the vulnerability had been patched previously.
A PoC/exploit has been discovered for vulnerability CVE-2026-64556 Vendor: Linux Product: Linux kernel Description: An issue exists in the perf/core component where the perf event remove on exec() function removes events by calling perf event exit event(). For top-level events, this process only uses DETACH EXIT, which can lead to an inconsistent group state if the removed event is a group leader and contains siblings that do not have remove on exec. In such cases, surviving siblings may remain active and attached to the removed leader's sibling list while lacking a valid group leader on the PMU (Performance Monitoring Unit) context active lists. A subsequent close of the removed leader using DETACH GROUP can promote these active siblings from the stale state, causing the next schedule-in to add an already-linked active list entry again, which corrupts the PMU context active list. This condition is detectable as a list add double-add in the merge sched in() function when DEBUG LIST is enabled. Link: https://github.com/google/security-research/tree/d9fa91ad8392ead13cbc53fb44a56b187dd88cb9/pocs/linux/kernelctf/CVE-2026-64556_lts/exploit/lts-6.12.91 #dbugs_vuln
Post summary
A proof‑of‑concept exploit for CVE‑2026‑64556 targeting the Linux kernel perf core component has been released, detailing the vulnerability mechanics and providing working code.
CVE-2026-64556 Linux Kernel perf/core Group State Inconsistency During Event Rem... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-64556 Vulnerability Alert Subscriptions: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=1
Post summary
The tweet links to a vulnerability alert for CVE-2026-64556 and briefly notes it as a Linux kernel perf/core group state issue, but offers no further technical, exploit, or mitigation details.