Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-23271 is a high-severity Race Condition (CWE-362) vulnerability in Linux Linux Kernel. Its CVSS base score is 7.8 (High).
Operationally, ranked at the 1.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-39 (Process Isolation) and SC-4 (Information in Shared System Resources) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-23271 is a race condition vulnerability in the Linux kernel's perf subsystem. The issue occurs between __perf_event_overflow() and perf_remove_from_context(), where __perf_event_overflow() can execute with only preemption disabled rather than IRQs disabled across all callchains, particularly for software events. This creates a race with perf_event_exit_event() and related functions that free resources expected to remain present in the overflow path, such as BPF programs.
The vulnerability carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating it can be exploited by a local attacker requiring low privileges, with low attack complexity and no user interaction. Successful exploitation could lead to high impacts on confidentiality, integrity, and availability, potentially through use-after-free scenarios involving freed kernel resources like BPF programs.
The vulnerability has been addressed in Linux kernel stable trees via patches in the following commits: https://git.kernel.org/stable/c/3f89b61dd504c5b6711de9759e053b082f9abf12, https://git.kernel.org/stable/c/4df1a45819e50993cb351682a6ae8e7ed2d233a0, https://git.kernel.org/stable/c/4f8d5812337871227bb2c98669a87c306a2f86ef, https://git.kernel.org/stable/c/5c48fdc4b4623533d86e279f51531a7ba212eb87, and https://git.kernel.org/stable/c/bb190628fe5f2a73ba762a9972ba16c5e895f73e. Security practitioners should update affected kernels to versions incorporating these fixes to ensure __perf_event_overflow() runs with IRQs disabled in all scenarios.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-13605
Vulnerability Data
In the Linux kernel, the following vulnerability has been resolved: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race Make sure that __perf_event_overflow() runs with IRQs disabled for all possible callchains. Specifically the software events can end up running it with only preemption…
more
disabled. This opens up a race vs perf_event_exit_event() and friends that will go and free various things the overflow path expects to be present, like the BPF program.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Maintaining separate execution domains for each process structurally eliminates unintended concurrent access to the same shared resources.
Preventing unintended information transfer through shared system resources directly addresses the improper concurrent modification that defines a race condition.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect race conditions, but does not prevent them at design or coding time.
Secure coding standards explicitly forbid unsafe concurrent access patterns and mandate atomic operations or locks.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.
- No fine-grained STIG row for CWE-362, a class-level weakness, and none of its children carries one either.