A flaw in the Linux kernel’s perf subsystem allows a node to be removed from the sched_cb_list while the list is still being traversed. This occurs when an ioctl() of type PERF_EVENT_IOC_REFRESH triggers perf_event_overflow(), which leads to pmu->stop() removing an entry from the list during an active iteration. The result is corruption of kernel data structures, potentially causing a crash or other unstable behavior. The patch replaces the unsafe for_each_list_entry with for_each_list_entry_safe to prevent the corruption.

This vulnerability applies to all Linux kernel builds that contain the unpatched perf/core implementation, including mainstream distributions prior to the commit 59e63416f5 and any custom kernels that have not integrated the fix.

Based on the description, it is inferred that an attacker would need local access to open a perf event and trigger the ioctl() sequence. The CVSS score is 5.5, the EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. The described list corruption could lead to kernel memory corruption or a crash, and while arbitrary code execution is not explicitly stated in the description, such an outcome is conceivable. The exploitation vector is therefore local, with risk moderate unless mitigated.