From mboxrd@z Thu Jan 1 00:00:00 1970 From: AL-KERNEL To: kernel-cve@kernelcve.org Subject: [CVE-2026-93817][IMPORTANT] perf: Fix addr_filter_ranges lifetime [ Upstream Date: Thu, 24 Sep 2026 21:01:09 -0400 Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-AL-KERNEL-CVE: CVE-2026-93817 X-AL-KERNEL-Priority: IMPORTANT X-AL-KERNEL-Severity: IMPORTANT X-AL-KERNEL-Base-Severity: IMPORTANT X-AL-KERNEL-KPANIC: YES X-AL-KERNEL-ActionableScore: 6 X-AL-KERNEL-ActionableScore-Lower: 5 X-AL-KERNEL-Commit: cd8dab11046c03ab07899ce3fe2aa7d1a9702cf1 List-Id: CVE: CVE-2026-93817 Priority: IMPORTANT AL-KERNEL base severity: IMPORTANT KPANIC flag: YES Patch: perf: Fix addr_filter_ranges lifetime [ Upstream Commit: cd8dab11046c03ab07899ce3fe2aa7d1a9702cf1 Upstream patch: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=cd8dab11046c03ab07899ce3fe2aa7d1a9702cf1 Original CVE announcement: https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-93817 Analysis date: Thu, 24 Sep 2026 21:01:09 -0400 ActionableScore: 6 ActionableScore lower bound: 5 Actionable bucket: Actionable Moderate / Strong Important candidate requiring manual review Manual review required: YES Summary: No one-sentence report phrase was found. ====================================================================== ABOUT THIS REPORT ====================================================================== The original Linux kernel CVE announcement for CVE-2026-93817 is available here: https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-93817 The original announcement does not normally provide a security severity estimate, CVSS assessment, or enough information to determine whether the reported kernel bug represents a practically relevant security issue. This report was generated by AL-KERNEL, an AI-assisted Linux kernel vulnerability analysis system developed by Alexander Larkin. It combines an autonomous classifier with LLM-assisted technical analysis and a separate ActionableScore mechanism. The purpose of this report is to prioritize Linux kernel CVEs before manual review, identify cases that require prompt investigation, and support automatic closure of issues that are unlikely to have meaningful security impact. Published priority for this report: IMPORTANT Manual review required: YES A detailed explanation of the methodology and priority rules is included at the end of this message. ====================================================================== AL-KERNEL CLASSIFICATION RESULT ====================================================================== CVE-2026-93817 IMPORTANT https://www.kernelcve.org/list/?q=CVE-2026-93817 CHECK WITH IMPACT FROM ORIG NN MODERATE Maybe valid. Check manually. Hints by AL-KERNEL: The best (paranoid) CVSS is 'AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H';*CWE-416;CWE-362;*CWE-664;Other CVSS 'AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H';BEST CVSS score: '7';DESCR 'A use after free may occur in the perf event address filter handling because event addr_filter_ranges is accessed by RCU readers but was freed before the RCU grace period completed. A local process able to create and destroy relevant perf events may race event teardown with an RCU reader that still holds the old pointer. The immediate impact can be a kernel crash. The stale pointer can theoretically reference reused kernel memory, so confidentiality integrity and privilege escalation impact cannot be excluded without additional manual review. For the CVSS the PR:L metric is used because a local process and practical access to the perf event interface are required. The issue is not network reachable. Reliable triggering requires a timing race and is therefore rated AC:H. Access may be limited by kernel.perf_event_paranoid, LSM policy, process capabilities, and PMU support for address filters.';YES REQUIRES MANUAL CHECK; ,and ActionableScore result is Actionable Moderate / Strong Important candidate requiring manual review (with actual score 6) YES DANGER SIMPLEFIX HARDWARE LINUS KPANIC KPANIC INCREASED_TO_HIGH_BASED_ON_GUESSCVSS NO NO checked ====================================================================== ACTIONABLESCORE ANALYSIS ====================================================================== ActionableScore=6 ActionableScoreLower=5 PrimitiveClass=CLASS_B RealUAF=YES HostAdminRequired=UNKNOWN NamespaceScopedPrivilege=UNKNOWN ImportantCandidate=YES ManualReview=REQUIRED AutoDowngradeAllowed=NO 1. ActionableScore * Raw conservative score: 3 * Conservative score: 5 * Raw paranoid score: 4 * Paranoid score: 6 * Final recommended bucket: **Actionable Moderate / Strong Important candidate requiring manual review**:: Raw conservative arithmetic: * +2 Real UAF. `event->addr_filter_ranges` is freed while RCU readers may still access it. * +1 Concrete RCU referenced-object lifetime mismatch. The containing `perf_event` remains RCU-visible, while its referenced address-filter allocation was released before the grace period. Applied conservative floor: 3 -> 5. This is an active RCU-consumed perf-event state allocation. Host-admin-equivalent access is not positively established, and the exact stale-reader behavior and attacker reachability require review. Raw paranoid arithmetic: * Same +3 established lifetime signals. * +1 Unresolved active RCU reader behavior. A legitimate concurrent reader may consume freed address-filter range state after the original allocation lifetime ended. No crash bonus was awarded because the supplied patch does not document an observed crash. No local-unprivileged-trigger bonus was awarded because the complete `perf_event` and address-filter permission path is not established. 2. Signal breakdown Positive signals: * +2 Real UAF. The commit explicitly states that `event->addr_filter_ranges` is used under RCU and therefore must be RCU-freed. Moving `kfree()` from `__free_event()` into `free_event_rcu()` directly fixes a post-free reader risk. * +1 Concrete RCU referenced-object lifetime mismatch. `perf_event` is deferred through an RCU callback, but its `addr_filter_ranges` member was previously freed before that callback. Readers protected by the event RCU lifetime could still dereference the member allocation. * +1 Paranoid only. The stale allocation is address-filter state associated with an active perf event, not merely passive diagnostic data. The exact reader operations and behavior after allocator reuse are not visible in the supplied context. Important non-awarded signals: * Controlled reclaim or attacker-controlled replacement of the freed allocation is not demonstrated. * Arbitrary or directed kernel write is not demonstrated. * Confidentiality and integrity impact are not awarded. A UAF alone does not establish disclosure or modification of protected data. * Remote reachability is not established. * Reliable kernel crash is plausible for a stale dereference but is not directly demonstrated by the supplied commit. * Local unprivileged triggering is not awarded because `perf_event_open`, address-filter configuration, PMU support, and `kernel.perf_event_paranoid` policy were not fully established. * No concrete repeated release, `put`, `kfree`, or refcount mutation occurs on the same dangling allocation. The patch changes one early `kfree()` into an RCU-delayed `kfree()`. * No structured stale-object leverage is separately awarded. The supplied patch establishes stale range access, but does not establish attacker-controlled post-free field consumption, callback dispatch, pointer traversal, or controlled type replacement. * No timing penalty is applied. RCU-reader overlap is established by the commit, but the supplied evidence does not prove a narrowly timed or externally uncontrollable one-shot race. 3. Reachability analysis The likely attacker model is a local process interacting with the perf-event interface and an address-filter-capable PMU. The complete trigger requires creation or configuration of a relevant perf event, concurrent event destruction, and a reader that accesses `event->addr_filter_ranges` under RCU. Host-admin-equivalent privilege is not positively established from the supplied patch. It is also not proven that an ordinary unprivileged user can perform the complete operation. Access may depend on `kernel.perf_event_paranoid`, `CAP_PERFMON`, `CAP_SYS_ADMIN` on older or restrictive configurations, LSM policy, PMU driver support, and availability of address-filter functionality. Namespace-scoped reachability is unresolved. No supplied evidence shows that all required perf-event and address-filter operations can be completed using only attacker-obtainable capabilities in a user namespace or another namespace. No network path, device firmware path, special physical hardware requirement, or prior privileged setup is directly established. Address filters may require particular PMU support, but this is not sufficient evidence for a niche-subsystem penalty because the exact deployment and access policy are unknown. The RCU overlap can normally be retried through repeated create, configure, and destroy activity if the interface is accessible. However, the supplied patch does not establish that an attacker controls the exact reader scheduling or allocator reuse. 4. Primitive and severity interpretation The exact primitive is a real RCU lifetime violation. A `perf_event` can remain legitimately visible to RCU readers while the separately allocated `event->addr_filter_ranges` memory has already been freed. A reader can therefore access memory outside the original allocation lifetime. This is an active structured-state UAF candidate rather than fixed async device storage. The stale allocation contains address-filter range data associated with perf-event processing. However, the visible patch does not show the reader call sites, the accessed fields, whether stale contents can be controlled after reuse, or whether a stale read can progress beyond an immediate fault. There is no concrete repeated release or refcount mutation. The first lifetime operation is a single `kfree(event->addr_filter_ranges)`. The fixed code delays that free until `free_event_rcu()`. There is no second `kfree`, `put`, release, or refcount operation on the same dangling reference. Therefore, the concrete repeated-release/refcount signal does not apply and FLOOR 5 is not applied for that reason. The issue is CLASS_B because a genuine kernel lifetime corruption primitive exists, but controlled reclaim, post-free structured replacement, arbitrary read or write, disclosure, integrity modification, or privilege escalation is not established. The demonstrated practical consequence is potential stale memory access and likely kernel instability or DoS. Privilege escalation remains speculative and is not scored as an established consequence. ImportantCandidate is YES because the defect is a concrete RCU lifetime mismatch involving an active perf-event allocation and the complete reader behavior, permission boundary, and post-free reuse conditions are unresolved. AutoDowngradeAllowed is NO because automatically closing it as an ordinary crash-only issue could discard a real kernel UAF before reader and reachability analysis is completed. Likely operational severity is Actionable Moderate at minimum. It is a strong candidate for Important-versus-Moderate manual review, but the supplied patch alone does not establish CLASS_A exploitation leverage. 5. One-sentence report phrase A local RCU lifetime bug in perf address-filter handling can allow readers to access freed `addr_filter_ranges` memory after perf-event teardown, creating a kernel use-after-free condition that requires manual review for crash and post-free reuse impact. 6. Manual review recommendation MANUAL CHECK REQUIRED A real RCU-protected UAF is directly established, while the relevant reader paths, perf-event permission policy, PMU address-filter exposure, and possible post-free allocation reuse are not visible in the supplied patch. 7. Call-site confidence Call-site confidence: medium ====================================================================== UPSTREAM PATCH SUMMARY ====================================================================== Patch: perf: Fix addr_filter_ranges lifetime [ Upstream Commit: cd8dab11046c03ab07899ce3fe2aa7d1a9702cf1 Upstream URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=cd8dab11046c03ab07899ce3fe2aa7d1a9702cf1 Changed files: kernel/events/core.c Diff excerpt: Not included in this email. See the upstream URL for the full patch. Full patch: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=cd8dab11046c03ab07899ce3fe2aa7d1a9702cf1 ====================================================================== DETAILED REPORT METHODOLOGY ====================================================================== The original Linux kernel CVE announcement for CVE-2026-93817 can be found here: https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-93817 The original CVE announcement normally does not include a security-level estimate. In particular, it may not contain a CVSS assessment, an impact level, or enough information to determine whether the reported bug is a practically relevant security issue. One purpose of this parallel CVE list is to provide that missing technical and prioritization information. The original goal of the AL-KERNEL project was to prioritize Linux kernel CVE analysis automatically before manual review. The system can also help identify non-security issues that may be suitable for automatic closure. This report was generated by AL-KERNEL, an AI-assisted Linux kernel vulnerability analysis system developed by Alexander Larkin. The first analysis stage combines an autonomous classifier with additional LLM-based analysis. The autonomous classifier runs locally on a CPU and is based on a backpropagation neural network. Together, these mechanisms produce a technical vulnerability description, identify likely weakness types, estimate CVSS severity, and provide input for ActionableScore. Two CVSS estimates are retained because incomplete kernel vulnerability information often permits more than one defensible interpretation: Conservative CVSS vector: AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H The Best / paranoid CVSS vector: AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H The Best / paranoid CVSS score: 7 The conservative vector represents a lower-impact interpretation. The Best/paranoid vector intentionally represents a plausible upper-bound interpretation and should not automatically be treated as demonstrated real-world impact. CVSS may also need to be adjusted for a particular Linux deployment, because actual reachability, privileges, enabled kernel configuration, hardware, namespaces, exposed device nodes, and other environmental conditions can differ significantly between systems. A separate ActionableScore mechanism evaluates practical remediation urgency. Its analysis may include reachability, attack prerequisites, subsystem exposure, memory-corruption characteristics, denial-of-service reliability, and possible confidentiality, integrity, or privilege-escalation impact. Conservative ActionableScore: 5 Paranoid ActionableScore: 6 The final base severity is taken directly from the second tab-separated field of the AL-KERNEL classification result. ActionableScore does not replace or independently override that final AL-KERNEL decision, and if ActionableScore adjusted impact level of ALKERNEL, then you would see self-readable flags above like INCREASED_TO_HIGH_BASED_ON_ACTIONABLESCOREHIGHEREQTHAN7. For an AL-KERNEL result of MODERATE, this report uses the following additional presentation split: ActionableScore below 5 -> MODERATE REGULAR ActionableScore 5 or more -> MODERATE 7.0 The distinction between MODERATE REGULAR and MODERATE 7.0 makes it possible to identify Moderate issues that should receive manual analysis and fixes before lower-priority MODERATE REGULAR issues. In many cases, MODERATE REGULAR fixes may wait for a later rebase or routine update. There is one override in which MODERATE REGULAR becomes MODERATE 7.0 even when the ActionableScore is below 5. When the AL-KERNEL result contains the KPANIC flag, a MODERATE result is always presented as MODERATE 7.0. The KPANIC flag selected with few regexps without usage of AI at all, so it helps to detect cases when Kernel Crash happens and similar (to filter False-Negative results from the LLM usage). KPANIC indicates that a reliable kernel crash, kernel panic, or similarly serious kernel availability impact was identified by the classification workflow. AL-KERNEL base severity for this report: IMPORTANT KPANIC detected for this report: YES Published priority for this report (same as in Subject): IMPORTANT These results are intended to support engineering triage. They are machine-generated estimates, and cases marked for manual review should be validated by a human security engineer before final disposition. For more info read docs linked from here: https://kernelcve.org/ (and you can submit you own patch there to generate such a report for non-existant CVE-id yet). Note that in many cases this AI tool selects higher severity, than real is (means you can expect Importants instead of Moderate 7.0 or Moderates 7.0 instead of regular Moderates). If you see such cases, please use reply email interface to add additional manual analyses info to this particular CVE. And please, please, let me know when you see Lows instead of Importants or Important instead of Low (because particular for such cases I need to tune this AI tool to make it better for this one and next similar). My contact email for such notifications is alexanjelausa@gmail.com (and both send reply to CVE record itself too and see "reply" button below for howto reply).