CVE-2026-97961

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97961", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:18:58.206Z", "datePublished": "2026-09-25T10:23:05.547Z", "dateUpdated": "2026-10-21T12:53:52.027Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:53:52.027Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/core: Allow list_del during perf_event_overflow()\n\nA PMU might use perf_sched_cb_inc() and perf_sched_cb_dec()\ninterface to get the PMU call back function pmu::sched_task\ninvoked at schedule in and schedule out. This is achieved\nby walking along the list anchored by sched_cb_list.\n\nThe following scenario might lead to a list corruption.\n\n perf_pmu_sched_task()\n for_each_list_entry(..., &sched_cb_list)\n +--> __perf_pmu_sched_task()\n +--> event->pmu->sched_task())\n +--> PMU_push_sample()\n +--> perf_event_overflow()\n +--> __perf_event_overflow()\n +--> pmu->stop()\n +--> perf_sched_cb_dec()\n remove entry from sched_cb_list\n while list node in use.\n\nThis happens when ioctl(fd, PERF_EVENT_IOC_REFRESH, xxx) has been\ninvoked and perf_event::event_limit hits zero.\n\nPrevent the list corruption and convert for_each_list_entry()\nto for_each_list_entry_safe()."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/events/core.c"], "versions": [{"version": "bd27568117664b8b3e259721393df420ed51f57b", "lessThan": "fa360a018369f3eb4fe4f4792238adfc1f6fd5dc", "status": "affected", "versionType": "git"}, {"version": "bd27568117664b8b3e259721393df420ed51f57b", "lessThan": "723e85fb2c3bcd237ac02cbd69502ed62ce0068c", "status": "affected", "versionType": "git"}, {"version": "bd27568117664b8b3e259721393df420ed51f57b", "lessThan": "6d0b9ce3be221c9077653f3670d60d66bb725ee2", "status": "affected", "versionType": "git"}, {"version": "bd27568117664b8b3e259721393df420ed51f57b", "lessThan": "e2770c76a02452fddb52e9e05c7ed6acfef06c32", "status": "affected", "versionType": "git"}, {"version": "bd27568117664b8b3e259721393df420ed51f57b", "lessThan": "59e63416f5153e7d58652c616fbdcb7d5e01fff7", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/events/core.c"], "versions": [{"version": "6.2", "status": "affected"}, {"version": "0", "lessThan": "6.2", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/fa360a018369f3eb4fe4f4792238adfc1f6fd5dc"}, {"url": "https://git.kernel.org/stable/c/723e85fb2c3bcd237ac02cbd69502ed62ce0068c"}, {"url": "https://git.kernel.org/stable/c/6d0b9ce3be221c9077653f3670d60d66bb725ee2"}, {"url": "https://git.kernel.org/stable/c/e2770c76a02452fddb52e9e05c7ed6acfef06c32"}, {"url": "https://git.kernel.org/stable/c/59e63416f5153e7d58652c616fbdcb7d5e01fff7"}], "title": "perf/core: Allow list_del during perf_event_overflow()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/events/core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "fa360a018369f3eb4fe4f4792238adfc1f6fd5dc", "status": "affected", "version": "bd27568117664b8b3e259721393df420ed51f57b", "versionType": "git"}, {"lessThan": "723e85fb2c3bcd237ac02cbd69502ed62ce0068c", "status": "affected", "version": "bd27568117664b8b3e259721393df420ed51f57b", "versionType": "git"}, {"lessThan": "6d0b9ce3be221c9077653f3670d60d66bb725ee2", "status": "affected", "version": "bd27568117664b8b3e259721393df420ed51f57b", "versionType": "git"}, {"lessThan": "e2770c76a02452fddb52e9e05c7ed6acfef06c32", "status": "affected", "version": "bd27568117664b8b3e259721393df420ed51f57b", "versionType": "git"}, {"lessThan": "59e63416f5153e7d58652c616fbdcb7d5e01fff7", "status": "affected", "version": "bd27568117664b8b3e259721393df420ed51f57b", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/events/core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.2"}, {"lessThan": "6.2", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/core: Allow list_del during perf_event_overflow()\n\nA PMU might use perf_sched_cb_inc() and perf_sched_cb_dec()\ninterface to get the PMU call back function pmu::sched_task\ninvoked at schedule in and schedule out. This is achieved\nby walking along the list anchored by sched_cb_list.\n\nThe following scenario might lead to a list corruption.\n\n perf_pmu_sched_task()\n for_each_list_entry(..., &sched_cb_list)\n +--> __perf_pmu_sched_task()\n +--> event->pmu->sched_task())\n +--> PMU_push_sample()\n +--> perf_event_overflow()\n +--> __perf_event_overflow()\n +--> pmu->stop()\n +--> perf_sched_cb_dec()\n remove entry from sched_cb_list\n while list node in use.\n\nThis happens when ioctl(fd, PERF_EVENT_IOC_REFRESH, xxx) has been\ninvoked and perf_event::event_limit hits zero.\n\nPrevent the list corruption and convert for_each_list_entry()\nto for_each_list_entry_safe()."}], "id": "CVE-2026-97961", "lastModified": "2026-10-21T13:21:17.717", "metrics": {}, "published": "2026-09-25T11:17:23.860", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/59e63416f5153e7d58652c616fbdcb7d5e01fff7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6d0b9ce3be221c9077653f3670d60d66bb725ee2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/723e85fb2c3bcd237ac02cbd69502ed62ce0068c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e2770c76a02452fddb52e9e05c7ed6acfef06c32"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fa360a018369f3eb4fe4f4792238adfc1f6fd5dc"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: perf/core: Allow list_del during perf_event_overflow()", "id": "2541098", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541098"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nperf/core: Allow list_del during perf_event_overflow()\nA PMU might use perf_sched_cb_inc() and perf_sched_cb_dec()\ninterface to get the PMU call back function pmu::sched_task\ninvoked at schedule in and schedule out. This is achieved\nby walking along the list anchored by sched_cb_list.\nThe following scenario might lead to a list corruption.\nperf_pmu_sched_task()\nfor_each_list_entry(..., &sched_cb_list)\n+--> __perf_pmu_sched_task()\n+--> event->pmu->sched_task())\n+--> PMU_push_sample()\n+--> perf_event_overflow()\n+--> __perf_event_overflow()\n+--> pmu->stop()\n+--> perf_sched_cb_dec()\nremove entry from sched_cb_list\nwhile list node in use.\nThis happens when ioctl(fd, PERF_EVENT_IOC_REFRESH, xxx) has been\ninvoked and perf_event::event_limit hits zero.\nPrevent the list corruption and convert for_each_list_entry()\nto for_each_list_entry_safe().", "A flaw was found in the Linux kernel's perf subsystem, which can lead to a Denial of Service (DoS). A local user can trigger this issue by manipulating performance monitoring event limits through I/O control (ioctl) requests. When the event limit expires, the kernel improperly removes an entry from an internal callback list while actively iterating over it, causing list corruption and crashing the system."], "name": "CVE-2026-97961", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-97961\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-97961\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97961.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bd27568117664b8b3e259721393df420ed51f57b,723e85fb2c3bcd237ac02cbd69502ed62ce0068c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bd27568117664b8b3e259721393df420ed51f57b,6d0b9ce3be221c9077653f3670d60d66bb725ee2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bd27568117664b8b3e259721393df420ed51f57b,e2770c76a02452fddb52e9e05c7ed6acfef06c32)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bd27568117664b8b3e259721393df420ed51f57b,59e63416f5153e7d58652c616fbdcb7d5e01fff7)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.2"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.2)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.111,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.7,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T19:30:20.154694+00:00", "updated": "2026-10-01T06:45:02.279562+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}