CVE-2026-74637 in Linux
Summary
by MITRE • 08/22/2026
In the Linux kernel, the following vulnerability has been resolved:
perf/core: Fix group leader use-after-free after sibling detach
perf_group_detach() handles leader and sibling detach differently. When the group leader is detached, all siblings are promoted to singleton events and their group_leader pointer is reset to themselves. When a sibling is detached, it is removed from the leader's sibling_list, but its group_leader pointer is left pointing at the old leader.
That is harmless when the sibling is being closed and freed immediately, as in the DETACH_DEAD path. It is not safe when the sibling is detached but kept alive, such as during CPU hotplug with DETACH_GROUP. In that case the sibling is removed from the context, while its file descriptor can still keep it alive.
A typical failing sequence is:
- A group contains leader L and sibling S. - CPU hot-unplug detaches S with DETACH_GROUP, removing it from L->sibling_list but leaving S->group_leader == L. - L is later closed and freed. - A PERF_IOC_FLAG_GROUP ioctl on S follows S->group_leader and dereferences the freed leader.
This was reproduced by running the perf event fuzzer, CPU hotplug, and a stress workload concurrently:
Unable to handle kernel paging request at virtual address 006b6b6b6b6b6cdb CPU: 2 PID: 12489 Comm: perf_fuzzer 6.18.7 PREEMPT pc : perf_ioctl+0x34c/0xc68 x20: ffffff89a3fa2c70 x8 : 6b6b6b6b6b6b6b6b Code: 943c4a0e 340047a0 f9404a94 f9411e88 (f940b908) Call trace: perf_ioctl+0x34c/0xc68 (P) __arm64_sys_ioctl+0xa0/0xf4 invoke_syscall+0x58/0xe4 el0_svc_common+0xa8/0xdc do_el0_svc+0x1c/0x28 el0_svc+0x40/0xc0 el0t_64_sync_handler+0x68/0xdc el0t_64_sync+0x1c4/0x1c8
The fault happened in perf_ioctl(), where perf_event_for_each() follows the stale group_leader pointer and perf_event_for_each_child() then dereferences the freed leader's context.
Fix the use-after-free by promoting the detached sibling to a singleton. Also fix __event_disable() cgroup accounting and event state change.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/23/2026
The Linux kernel performance subsystem contains a critical memory safety vulnerability identified as CVE-2024-something, specifically involving a use-after-free condition within the perf core module when handling group leader detachment during CPU hotplug operations. This flaw stems from an inconsistency in how the kernel manages event groups consisting of a leader and multiple sibling events. When a performance monitoring group is detached, the system must ensure that all references to shared resources are properly invalidated or redirected to prevent dangling pointers. The vulnerability arises because the detach logic treats the removal of a group leader differently than the removal of a sibling event. Specifically, when a group leader is detached, the kernel correctly promotes any remaining siblings to become singleton events and resets their internal group_leader pointer to point at themselves, thereby maintaining structural integrity. However, when a sibling event is detached from its leader while the leader remains active or is subsequently removed, the kernel fails to update the sibling's group_leader pointer. This leaves the sibling with a stale reference pointing to the original leader structure in memory.
The operational impact of this vulnerability becomes severe during CPU hotplug scenarios where events are dynamically moved between CPUs using the DETACH_GROUP flag. In such cases, the sibling event is removed from the current context but remains alive because its file descriptor keeps it referenced by user-space processes. If the group leader is subsequently closed and freed while the stale reference persists in the detached sibling, any subsequent operation on that sibling will attempt to follow the now-invalid pointer. A typical exploitation sequence involves a perf fuzzer or stress workload triggering CPU hot-unplug events concurrently with event management operations. When an ioctl call such as PERF_IOC_FLAG_GROUP is issued for the affected sibling, the kernel attempts to traverse the group structure by following the stale group_leader pointer. This leads to a dereference of freed memory, resulting in a kernel paging request fault and potentially causing system instability or a denial of service through a kernel panic. The technical trace indicates that the crash occurs within perf_ioctl as it calls perf_event_for_each, which then invokes perf_event_for_each_child on the corrupted context pointer.
From a security classification perspective, this vulnerability is categorized under CWE-416: Use After Free, which describes situations where memory is accessed after it has been freed, leading to undefined behavior and potential code execution if an attacker can control the contents of the reclaimed memory. In the context of the MITRE ATT&CK framework for Linux systems, this flaw aligns with techniques related to privilege escalation or denial of service via kernel exploitation. Although the immediate manifestation is a crash due to invalid pointer dereference, use-after-free vulnerabilities in core subsystems like perf are often considered high-risk because they can potentially be leveraged to achieve arbitrary code execution if the freed memory region is reallocated and populated with attacker-controlled data before being accessed again. The vulnerability highlights the complexity of managing reference counts and lifecycle states for kernel objects that have interdependent relationships, particularly under concurrent access conditions involving hardware topology changes like CPU hotplug.
To mitigate this risk, the Linux kernel maintainers have implemented a fix that ensures detached sibling events are properly promoted to singleton status regardless of whether they were removed due to death or group detachment. This involves updating the __event_disable function to correctly handle cgroup accounting and event state transitions when siblings are separated from their leaders. By resetting the group_leader pointer for all detached siblings, the kernel prevents any subsequent operations on these events from following stale references into freed memory regions. System administrators should ensure that systems running affected versions of the Linux kernel are updated with the latest patches addressing this perf core issue. Additionally, organizations relying on performance monitoring tools in virtualized or cloud environments where CPU hotplug is common should verify their patch levels to prevent potential stability issues and security exposures arising from these race conditions during dynamic resource management operations.