CVE-2013-2094: The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect i...

Security readout for executives and security teams

CVE-2013-2094 is a Linux kernel privilege-escalation flaw in the perf subsystem. A local user could abuse a crafted perf_event_open call to gain higher privileges. The bundle marks this CVE as CISA KEV, so treat remaining vulnerable kernels as urgent legacy-risk exposure. Exposure is mainly legacy Linux hosts, appliances, containers sharing vulnerable host kernels, or unpatched distribution kernels from the 2013 era. The bundle cites Ubuntu, Red Hat/CentOS, openSUSE, and Mandriva advisories, but exact affected package versions must be confirmed from each vendor advisory. High priority for any remaining legacy Linux estate. Although old, KEV status and public exploit references make it unacceptable on shared, multi-user, or externally managed systems. Patch or retire affected hosts before broader modernization work. Mitigation focus: Update affected Linux kernels using vendor-provided security packages.; Confirm the kernel includes upstream fix 8176cced706b5e5d15887584150764894e94e02f or later equivalent.; Prioritize internet-facing multi-user systems and shared hosting hosts..

Prepared

May 22, 2026, 05:52 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.