{"id":"CVE-2024-43870","summary":"perf: Fix event leak upon exit","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nperf: Fix event leak upon exit\n\nWhen a task is scheduled out, pending sigtrap deliveries are deferred\nto the target task upon resume to userspace via task_work.\n\nHowever failures while adding an event's callback to the task_work\nengine are ignored. And since the last call for events exit happen\nafter task work is eventually closed, there is a small window during\nwhich pending sigtrap can be queued though ignored, leaking the event\nrefcount addition such as in the following scenario:\n\n    TASK A\n    -----\n\n    do_exit()\n       exit_task_work(tsk);\n\n       \u003cIRQ\u003e\n       perf_event_overflow()\n          event-\u003epending_sigtrap = pending_id;\n          irq_work_queue(&event-\u003epending_irq);\n       \u003c/IRQ\u003e\n    =========\u003e PREEMPTION: TASK A -\u003e TASK B\n       event_sched_out()\n          event-\u003epending_sigtrap = 0;\n          atomic_long_inc_not_zero(&event-\u003erefcount)\n          // FAILS: task work has exited\n          task_work_add(&event-\u003epending_task)\n       [...]\n       \u003cIRQ WORK\u003e\n       perf_pending_irq()\n          // early return: event-\u003eoncpu = -1\n       \u003c/IRQ WORK\u003e\n       [...]\n    =========\u003e TASK B -\u003e TASK A\n       perf_event_exit_task(tsk)\n          perf_event_exit_event()\n             free_event()\n                WARN(atomic_long_cmpxchg(&event-\u003erefcount, 1, 0) != 1)\n                // leak event due to unexpected refcount == 2\n\nAs a result the event is never released while the task exits.\n\nFix this with appropriate task_work_add()'s error handling.","modified":"2026-04-16T04:34:20.430361432Z","published":"2024-08-21T00:06:21.878Z","related":["SUSE-SU-2024:3551-1","SUSE-SU-2024:3553-1","SUSE-SU-2024:3561-1","SUSE-SU-2024:3564-1","SUSE-SU-2025:20073-1","SUSE-SU-2025:20077-1"],"database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/43xxx/CVE-2024-43870.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/05d3fd599594abf79aad4484bccb2b26e1cb0b51"},{"type":"WEB","url":"https://git.kernel.org/stable/c/2fd5ad3f310de22836cdacae919dd99d758a1f1b"},{"type":"WEB","url":"https://git.kernel.org/stable/c/3d7a63352a93bdb8a1cdf29606bf617d3ac1c22a"},{"type":"WEB","url":"https://git.kernel.org/stable/c/67fad724f1b568b356c1065d50df46e6b30eb2f7"},{"type":"WEB","url":"https://git.kernel.org/stable/c/70882d7fa74f0731492a0d493e8515a4f7131831"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/43xxx/CVE-2024-43870.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43870"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"8bffa95ac19ff27c8261904f89d36c7fcf215d59"},{"fixed":"67fad724f1b568b356c1065d50df46e6b30eb2f7"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"517e6a301f34613bff24a8e35b5455884f2d83d8"},{"fixed":"70882d7fa74f0731492a0d493e8515a4f7131831"},{"fixed":"05d3fd599594abf79aad4484bccb2b26e1cb0b51"},{"fixed":"3d7a63352a93bdb8a1cdf29606bf617d3ac1c22a"},{"fixed":"2fd5ad3f310de22836cdacae919dd99d758a1f1b"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"0"},{"last_affected":"78e1317a174edbfd1182599bf76c092a2877672c"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-43870.json"}}],"schema_version":"1.7.5"}