CVE-2024-43870

What it actually does

Race condition in Linux kernel perf events allows pending sigtrap task_work to be ignored after task_work_exit, leaking event refcounts and preventing free_event from releasing the object.

Why it matters to the business

Long-running systems may accumulate leaked kernel memory objects from the perf subsystem, leading to gradual resource exhaustion that can impair performance monitoring and eventually cause stability issues on Linux hosts.

How an attack unfolds

An attacker or workload triggers repeated perf event overflows with sigtrap delivery around task preemption and exit boundaries; when task_work_add fails after exit_task_work, the refcount increment is lost and the event leaks on perf_event_exit_task.

How to fix it

Update the Linux kernel to commit 830b3c68c1fb1e9176028d02ef86f3cf76aa2476 or later; rebuild and deploy the fixed kernel image, then reboot affected systems.

How to confirm the fix worked

Verify the running kernel contains commit 830b3c68c1fb1e9176028d02ef86f3cf76aa2476; confirm absence of the WARN in perf_event_exit_event paths under load that previously triggered the leak.

Typical attack path

1. Create perf events configured for sigtrap delivery
2. Induce scheduling and IRQ-driven overflows near task exit
3. Force preemption so event_sched_out runs after task_work has closed
4. Observe ignored task_work_add failure and resulting refcount leak

How to detect it

Search kernel logs for the exact WARN emitted by perf_event_exit_event when refcount fails to drop to 1; correlate with perf event creation and task exit patterns in audit or syscall logs.

• WARN(atomic_long_cmpxchg(&event->refcount, 1, 0) != 1)
• perf_pending_irq early return with oncpu == -1
• event->pending_sigtrap set followed by task_work_add failure

What your security team should do

• Apply the referenced kernel commit or distribution update immediately on all production Linux systems
• Prioritize hosts running perf-based monitoring or high event turnover workloads
• Monitor for the specific WARN message in kernel logs as a post-patch validation step