CVE-2024-43869

What it actually does

Race condition in Linux kernel perf subsystem allows pending task work to remain unsynchronized when a child event is freed via free_event() during exec or release, resulting in an unreferenced event object that is never cleaned up.

Why it matters to the business

Linux systems running perf monitoring may experience gradual memory exhaustion or unexpected kernel instability when processes perform frequent exec or perf file operations, increasing operational risk on servers and embedded devices that rely on performance tracing.

How an attack unfolds

An attacker with permission to create perf events triggers an overflow that queues pending IRQ and task work, then forces an exec or concurrent release path that frees the event before the pending task work executes, leaking the object without ever waiting for or canceling the work item.

How to fix it

Upgrade the Linux kernel to a version containing commit 830b3c68c1fb1e9176028d02ef86f3cf76aa2476 or later; rebuild and reboot all affected systems with the patched kernel image.

How to confirm the fix worked

Confirm the running kernel Git commit or package version includes 830b3c68c1fb1e9176028d02ef86f3cf76aa2476; attempt to reproduce the original leak scenario under load and verify no WARN on refcount during free_event.

Typical attack path

1. Obtain ability to create and configure perf events
2. Cause perf_event_overflow to set pending_sigtrap and queue irq_work
3. Trigger task switch that schedules pending_task work via event_sched_out
4. Initiate exec or perf_event_release that reaches free_event on a child event
5. Bypass refcount check and free the event while pending task work still references it

How to detect it

Review kernel logs for perf-related WARN messages on refcount during event free; inspect audit or syscall logs for sequences of perf_event_open followed immediately by execve in the same process; correlate with memory usage anomalies in perf-monitored workloads.

What your security team should do

• Prioritize kernel updates on any system exposing perf to untrusted workloads
• Restrict perf_event_paranoid to limit unprivileged perf access until patched
• Monitor for kernel memory growth correlated with high exec or perf activity