In the Linux kernel, the following vulnerability has been resolved:
perf: Ensure swevent hrtimer is properly destroyed
With the change to hrtimertrytocancel() in perfsweventcancelhrtimer() it appears possible for the hrtimer to still be active by the time the event gets freed.
Make sure the event does a full hrtimercancel() on the free path by installing a perfevent::destroy handler.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23014.json"
}