CVE-2026-98790

Source
https://cve.org/CVERecord?id=CVE-2026-98790
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98790.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-98790
Downstream
Published
2026-10-18T15:48:27Z
Modified
2026-10-20T02:31:12Z
Summary
perf: Fix race between perf_event_exit_task() and perf_pending_task()
Details

In the Linux kernel, the following vulnerability has been resolved:

perf: Fix race between perf_event_exit_task() and perf_pending_task()

A race condition exists between perf_event_exit_task() and perf_pending_task() during begin_new_exec().

During begin_new_exec(), perf_event_exit_task() may be called, and the PF_EXITING flag is not set on task. So perf_sigtrap() continues to execute and triggers WARN_ON_ONCE(event->ctx->task != current).

Since both task exit and exec paths can call perf_event_exit_task() which sets ctx->task to TASK_TOMBSTONE, fix this by explicitly checking if event->ctx->task equals TASK_TOMBSTONE and dropping the redundant PF_EXITING check.

Database specific
{
    "cna_assigner":  "Linux",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98790.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
97ba62b278674293762c3d91f724f1bb922f04e0
Fixed
672b8a9ce8f51b991481dfde26fba5cc4340a91a
Fixed
524063fea29f8a841e49927ea7a8085194ad3ec2
Fixed
81e61e3f8befa1bae3ec8e779d8ada5e5e362c21
Fixed
ffb684f2aa141eeb0caa6308422e7e05d1ded7c4

Database specific

source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98790.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.13.0
Fixed
6.12.113
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.56
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.2.10

Database specific

source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98790.json"