{"schema":"threatline.record/2","record":{"id":"CVE-2026-98790","aliases":[],"summary":"perf: Fix race between perf_event_exit_task() and perf_pending_task()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nperf: Fix race between perf_event_exit_task() and perf_pending_task()\n\nA race condition exists between perf_event_exit_task() and\nperf_pending_task() during begin_new_exec().\n\nDuring begin_new_exec(), perf_event_exit_task() may be called, and the\nPF_EXITING flag is not set on task. So perf_sigtrap() continues to execute\nand triggers WARN_ON_ONCE(event->ctx->task != current).\n\nSince both task exit and exec paths can call perf_event_exit_task() which\nsets ctx->task to TASK_TOMBSTONE, fix this by explicitly checking if\nevent->ctx->task equals TASK_TOMBSTONE and dropping the redundant\nPF_EXITING check.","categories":["Operating systems"],"product":"Linux","vendor":"Linux","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98790","source_modified_at":"2026-10-21T12:57:00.544Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Linux","vendor":"Linux","versions":[{"version":"97ba62b278674293762c3d91f724f1bb922f04e0","lessThan":"655acfa713bce9ae9c81a654459890c2f58cb4e8","status":"affected","versionType":"git"},{"version":"97ba62b278674293762c3d91f724f1bb922f04e0","lessThan":"672b8a9ce8f51b991481dfde26fba5cc4340a91a","status":"affected","versionType":"git"},{"version":"97ba62b278674293762c3d91f724f1bb922f04e0","lessThan":"524063fea29f8a841e49927ea7a8085194ad3ec2","status":"affected","versionType":"git"},{"version":"97ba62b278674293762c3d91f724f1bb922f04e0","lessThan":"81e61e3f8befa1bae3ec8e779d8ada5e5e362c21","status":"affected","versionType":"git"},{"version":"97ba62b278674293762c3d91f724f1bb922f04e0","lessThan":"ffb684f2aa141eeb0caa6308422e7e05d1ded7c4","status":"affected","versionType":"git"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98790","source_modified_at":"2026-10-21T12:57:00.544Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Linux","vendor":"Linux","versions":[{"version":"5.13","status":"affected"},{"version":"0","lessThan":"5.13","status":"unaffected","versionType":"semver"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.113","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.56","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2.10","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}],"defaultStatus":"affected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98790","source_modified_at":"2026-10-21T12:57:00.544Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"655acfa713bce9ae9c81a654459890c2f58cb4e8","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98790","source_modified_at":"2026-10-21T12:57:00.544Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"672b8a9ce8f51b991481dfde26fba5cc4340a91a","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98790","source_modified_at":"2026-10-21T12:57:00.544Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"524063fea29f8a841e49927ea7a8085194ad3ec2","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-98790","source_modified_at":"2026-10-21T12:57:00.544Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"81e61e3f8befa1bae3ec8e779d8ada5e5e362c21","basis":"first unaffected version stated in the CVE record"}],"cvss":null,"severity":null,"kev":{"listed":false},"epss":{"probability":0.00168,"percentile":0.05742,"score_date":"2026-10-23"},"published_at":"2026-10-18T15:48:27.412Z","modified_at":"2026-10-21T12:57:00.544Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-98790","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-21T12:57:00.544Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98790","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://git.kernel.org/stable/c/655acfa713bce9ae9c81a654459890c2f58cb4e8"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/672b8a9ce8f51b991481dfde26fba5cc4340a91a"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/524063fea29f8a841e49927ea7a8085194ad3ec2"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/81e61e3f8befa1bae3ec8e779d8ada5e5e362c21"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/ffb684f2aa141eeb0caa6308422e7e05d1ded7c4"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-21T12:57:00.544Z","content_hash":"817e50b69038fc143930fb86a4067951ef7da018d4cdc57f3f8068ffe55d0af5"}}