{"id":"DEBIAN-CVE-2024-43870","details":"In the Linux kernel, the following vulnerability has been resolved:  perf: Fix event leak upon exit  When a task is scheduled out, pending sigtrap deliveries are deferred to the target task upon resume to userspace via task_work.  However failures while adding an event's callback to the task_work engine are ignored. And since the last call for events exit happen after task work is eventually closed, there is a small window during which pending sigtrap can be queued though ignored, leaking the event refcount addition such as in the following scenario:      TASK A     -----      do_exit()        exit_task_work(tsk);         \u003cIRQ\u003e        perf_event_overflow()           event-\u003epending_sigtrap = pending_id;           irq_work_queue(&event-\u003epending_irq);        \u003c/IRQ\u003e     =========\u003e PREEMPTION: TASK A -\u003e TASK B        event_sched_out()           event-\u003epending_sigtrap = 0;           atomic_long_inc_not_zero(&event-\u003erefcount)           // FAILS: task work has exited           task_work_add(&event-\u003epending_task)        [...]        \u003cIRQ WORK\u003e        perf_pending_irq()           // early return: event-\u003eoncpu = -1        \u003c/IRQ WORK\u003e        [...]     =========\u003e TASK B -\u003e TASK A        perf_event_exit_task(tsk)           perf_event_exit_event()              free_event()                 WARN(atomic_long_cmpxchg(&event-\u003erefcount, 1, 0) != 1)                 // leak event due to unexpected refcount == 2  As a result the event is never released while the task exits.  Fix this with appropriate task_work_add()'s error handling.","modified":"2026-09-15T09:03:10.807164478Z","published":"2024-08-21T01:15:11.620Z","upstream":["CVE-2024-43870"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2024-43870"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.106-1"}]}],"versions":["6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1","6.1.64-1","6.1.66-1","6.1.67-1","6.1.69-1","6.1.69-1~bpo11+1","6.1.76-1","6.1.76-1~bpo11+1","6.1.82-1","6.1.85-1","6.1.90-1","6.1.90-1~bpo11+1","6.1.94-1","6.1.94-1~bpo11+1","6.1.98-1","6.1.99-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-43870.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.10.3-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-43870.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.10.3-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-43870.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}