Cloudanix VulnDB

CVE-2026-98790

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing problem in the Linux kernel's performance tracking code could cause unexpected warnings or hiccups when programs start or stop, so updating the kernel removes the issue.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Other
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Race condition between perf_event_exit_task() and perf_pending_task() during begin_new_exec() allows perf_sigtrap() to execute without PF_EXITING set, triggering WARN_ON_ONCE when event->ctx->task != current after ctx->task is set to TASK_TOMBSTONE.

Why it matters to the business

Kernel warnings and potential instability during process exec or exit paths in Linux systems using performance monitoring, increasing operational noise and risk of unexpected behavior in production workloads.

How an attack unfolds

An attacker triggers repeated exec and exit sequences on a monitored task to hit the narrow race window between perf_event_exit_task() clearing context and perf_pending_task() dereferencing it, resulting in the warning condition; no known actors or ransomware campaigns are associated.

How to fix it

Upgrade to a Linux kernel containing the fix that adds explicit TASK_TOMBSTONE check in perf_pending_task() and removes the redundant PF_EXITING guard; apply the patch or newer stable release as soon as available.

How to confirm the fix worked

Confirm the presence of the TASK_TOMBSTONE equality check in perf_event.c around the perf_pending_task path and verify absence of the original WARN_ON_ONCE during exec/exit stress testing.

Typical attack path

  1. Start a process under perf monitoring
  2. Trigger concurrent execve() and exit paths rapidly
  3. Force perf_sigtrap() execution before TASK_TOMBSTONE check
  4. Observe kernel warning or context mismatch

How to detect it

Search kernel logs for the specific WARN_ON_ONCE message referencing event->ctx->task mismatch during exec or exit; no public exploitation artifacts exist.

What your security team should do

  • Monitor kernel changelogs for perf-related fixes in upcoming releases
  • Prioritize kernel updates on systems with heavy perf usage
  • Review logs for perf-related warnings as a general stability indicator

The record

In the Linux kernel, the following vulnerability has been resolved: perf: Fix race between perf_event_exit_task() and perf_pending_task() A race condition exists between perf_event_exit_task() and perf_pending_task() during begin_new_exec(). During begin_new_exec(), perf_event_exit_task() may be called, and the PF_EXITING flag is not set on task. So perf_sigtrap() continues to execute and triggers WARN_ON_ONCE(event->ctx->task != current). Since both task exit and exec paths can call perf_event_exit_task() which sets ctx->task to TASK_TOMBSTONE, fix this by explicitly checking if event->ctx->task equals TASK_TOMBSTONE and dropping the redundant PF_EXITING check.

Affected packages

Ecosystem Package Introduced Fixed