perf: Fix event leak upon exit
In the Linux kernel, the following vulnerability has been resolved: perf: Fix event leak upon exit When a task is scheduled out, pending sigtrap deliveries are deferred to the target task upon resume to userspace via task_work. However failures while adding an event's callback to the task_work engine are ignored. And since the last call for events exit happen after task work is eventually closed, there is a small window during which pending sigtrap can be queued though ignored, leaking the event refcount addition such as in the following scenario: TASK A ----- do_exit() exit_task_work(tsk); perf_event_overflow() event->pending_sigtrap = pending_id; irq_work_queue(&event->pending_irq); =========> PREEMPTION: TASK A -> TASK B event_sched_out() event->pending_sigtrap = 0; atomic_long_inc_not_zero(&event->refcount) // FAILS: task work has exited task_work_add(&event->pending_task) [...] perf_pending_irq() // early return: event->oncpu = -1 [...] =========> TASK B -> TASK A perf_event_exit_task(tsk) perf_event_exit_event() free_event() WARN(atomic_long_cmpxchg(&event->refcount, 1, 0) != 1) // leak event due to unexpected refcount == 2 As a result the event is never released while the task exits. Fix this with appropriate task_work_add()'s error handling.
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 5.15.165, 6.1.103, 6.10.3, 6.6.44
- CVEs
- CVE-2024-43870
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 08:08 UTC · Revision 1
Source evidence
In the Linux kernel, the following vulnerability has been resolved: perf: Fix event leak upon exit When a task is scheduled out, pending sigtrap deliveries are deferred to the target task upon resume to userspace via task_work. However failures while adding an event's callback to the task_work engine are ignored. And since the last call for events exit happen after task work is eventually closed, there is a small window during which pending sigtrap can be queued though ignored, leaking the event refcount addition such as in the following scenario: TASK A ----- do_exit() exit_task_work(tsk); perf_event_overflow() event->pending_sigtrap = pending_id; irq_work_queue(&event->pending_irq); =========> PREEMPTION: TASK A -> TASK B event_sched_out() event->pending_sigtrap = 0; atomic_long_inc_not_zero(&event->refcount) // FAILS: task work has exited task_work_add(&event->pending_task) [...] perf_pending_irq() // early return: event->oncpu = -1 [...] =========> TASK B -> TASK A perf_event_exit_task(tsk) perf_event_exit_event() free_event() WARN(atomic_long_cmpxchg(&event->refcount, 1, 0) != 1) // leak event due to unexpected refcount == 2 As a result the event is never released while the task exits. Fix this with appropriate task_work_add()'s error handling.
osv:CVE-2024-43870
Kernel
Fixed versions: 5.15.165, 6.1.103, 6.6.44, 6.10.3
Complete source record
{
"id": "1af2644a586b27ae888e88f55f0cf416989e31b2be775b74ff58b092833e1ad1",
"url": "https://osv.dev/vulnerability/CVE-2024-43870",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "perf: Fix event leak upon exit",
"summary": "In the Linux kernel, the following vulnerability has been resolved: perf: Fix event leak upon exit When a task is scheduled out, pending sigtrap deliveries are deferred to the target task upon resume to userspace via task_work. However failures while adding an event's callback to the task_work engine are ignored. And since the last call for events exit happen after task work is eventually closed, there is a small window during which pending sigtrap can be queued though ignored, leaking the event refcount addition such as in the following scenario: TASK A ----- do_exit() exit_task_work(tsk); perf_event_overflow() event->pending_sigtrap = pending_id; irq_work_queue(&event->pending_irq); =========> PREEMPTION: TASK A -> TASK B event_sched_out() event->pending_sigtrap = 0; atomic_long_inc_not_zero(&event->refcount) // FAILS: task work has exited task_work_add(&event->pending_task) [...] perf_pending_irq() // early return: event->oncpu = -1 [...] =========> TASK B -> TASK A perf_event_exit_task(tsk) perf_event_exit_event() free_event() WARN(atomic_long_cmpxchg(&event->refcount, 1, 0) != 1) // leak event due to unexpected refcount == 2 As a result the event is never released while the task exits. Fix this with appropriate task_work_add()'s error handling.",
"evidence": "osv:CVE-2024-43870",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "5.15.165",
"evidence": "/affected/1/ranges"
},
{
"value": "6.1.103",
"evidence": "/affected/1/ranges"
},
{
"value": "6.6.44",
"evidence": "/affected/1/ranges"
},
{
"value": "6.10.3",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "CVE-2024-43870",
"aliases": [
"CVE-2024-43870"
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "8bffa95ac19ff27c8261904f89d36c7fcf215d59"
},
{
"fixed": "67fad724f1b568b356c1065d50df46e6b30eb2f7"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "517e6a301f34613bff24a8e35b5455884f2d83d8"
},
{
"fixed": "70882d7fa74f0731492a0d493e8515a4f7131831"
},
{
"fixed": "05d3fd599594abf79aad4484bccb2b26e1cb0b51"
},
{
"fixed": "3d7a63352a93bdb8a1cdf29606bf617d3ac1c22a"
},
{
"fixed": "2fd5ad3f310de22836cdacae919dd99d758a1f1b"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "5.15.84"
},
{
"fixed": "5.15.165"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "6.0.14"
},
{
"fixed": "6.1"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "78e1317a174edbfd1182599bf76c092a2877672c"
}
]
}
],
"versions": [
"v5.15.164",
"v5.15.163",
"v5.15.162",
"v5.15.161",
"v5.15.160",
"v5.15.159",
"v5.15.158",
"v5.15.157",
"v5.15.156",
"v5.15.155",
"v5.15.154",
"v5.15.153",
"v5.15.152",
"v5.15.151",
"v5.15.150",
"v5.15.149",
"v5.15.148",
"v5.15.147",
"v5.15.146",
"v5.15.145",
"v5.15.144",
"v5.15.143",
"v5.15.142",
"v5.15.141",
"v5.15.140",
"v5.15.139",
"v5.15.138",
"v5.15.137",
"v5.15.136",
"v5.15.135",
"v5.15.134",
"v5.15.133",
"v5.15.132",
"v5.15.131",
"v5.15.130",
"v5.15.129",
"v5.15.128",
"v5.15.127",
"v5.15.126",
"v5.15.125",
"v5.15.124",
"v5.15.123",
"v5.15.122",
"v5.15.121",
"v5.15.120",
"v5.15.119",
"v5.15.118",
"v5.15.117",
"v5.15.116",
"v5.15.115",
"v5.15.114",
"v5.15.113",
"v5.15.112",
"v5.15.111",
"v5.15.110",
"v5.15.109",
"v5.15.108",
"v5.15.107",
"v5.15.106",
"v5.15.105",
"v5.15.104",
"v5.15.103",
"v5.15.102",
"v5.15.101",
"v5.15.100",
"v5.15.99",
"v5.15.98",
"v5.15.97",
"v5.15.96",
"v5.15.95",
"v5.15.94",
"v5.15.93",
"v5.15.92",
"v5.15.91",
"v5.15.90",
"v5.15.89",
"v5.15.88",
"v5.15.87",
"v5.15.86",
"v5.15.85",
"v5.15.84",
"v6.0.19",
"v6.0.18",
"v6.0.17",
"v6.0.16",
"v6.0.15",
"v6.0.14"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-43870.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5.15.165"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.16.0"
},
{
"fixed": "6.1.103"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.1.0"
},
{
"fixed": "6.6.44"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.2.0"
},
{
"fixed": "6.10.3"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-43870.json"
}
}
],
"modified": "2026-10-28T02:30:27.298049044Z",
"provider": "osv",
"references": [
"https://git.kernel.org/stable/c/05d3fd599594abf79aad4484bccb2b26e1cb0b51",
"https://git.kernel.org/stable/c/2fd5ad3f310de22836cdacae919dd99d758a1f1b",
"https://git.kernel.org/stable/c/3d7a63352a93bdb8a1cdf29606bf617d3ac1c22a",
"https://git.kernel.org/stable/c/67fad724f1b568b356c1065d50df46e6b30eb2f7",
"https://git.kernel.org/stable/c/70882d7fa74f0731492a0d493e8515a4f7131831",
"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/43xxx/CVE-2024-43870.json",
"https://nvd.nist.gov/vuln/detail/CVE-2024-43870",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/43xxx/CVE-2024-43870.json"
}
},
"related_cves": [
{
"value": "CVE-2024-43870",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 493652,
"published_at": "2024-08-21T00:06:21.878+00:00"
}