CVE-2024-56665 bpf,perf: Fix invalid prog_array access in perf_event_detach_bpf_prog

Medium 5.5 Published 27 Dec 2024 Updated 23 May 2026

A null pointer dereference in the Linux kernel's perf subsystem allows local attackers to cause a system crash by triggering a specific race condition during event detachment.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2024-56665?

CVE-2024-56665 is a medium-severity vulnerability in Linux kernel, published on 27 Dec 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

bpf,perf: Fix invalid prog_array access in perf_event_detach_bpf_prog

Syzbot reported [1] crash that happens for following tracing scenario:

- create tracepoint perf event with attr.inherit=1, attach it to the process and set bpf program to it - attached process forks -> chid creates inherited event

the new child event shares the parent's bpf program and tp_event (hence prog_array) which is global for tracepoint

- exit both process and its child -> release both events - first perf_event_detach_bpf_prog call will release tp_event->prog_array and second perf_event_detach_bpf_prog will crash, because tp_event->prog_array is NULL

The fix makes sure the perf_event_detach_bpf_prog checks prog_array is valid before it tries to remove the bpf program from it.

[1] https://lore.kernel.org/bpf/Z1MR6dCIKajNS6nU@krava/T/#m91dbf0688221ec7a7fc95e896a7ef9ff93b0b8ad

Which versions are affected by CVE-2024-56665?

It affects 1 product.

Products include Linux kernel.

How do I fix CVE-2024-56665?

Apply the vendor's patch.

Is CVE-2024-56665 being exploited?

There is no known exploitation of CVE-2024-56665 in the wild and no public exploit code.

All Linux kernel vulnerabilities

Sources

Also known as AZL-54770, AZL-55306, BELL-CVE-2024-56665, DEBIAN-CVE-2024-56665, GHSA-2x5w-q4pc-79qx, ROOT-OS-UBUNTU-2204-CVE-2024-56665 and 1 more.