CVE-2026-74637

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

perf/core: Fix group leader use-after-free after sibling detach

perf_group_detach() handles leader and sibling detach differently. When the

group leader is detached, all siblings are promoted to singleton events and

their group_leader pointer is reset to themselves. When a sibling is

detached, it is removed from the leader's sibling_list, but its

group_leader pointer is left pointing at the old leader.

That is harmless when the sibling is being closed and freed immediately, as

in the DETACH_DEAD path. It is not safe when the sibling is detached but

kept alive, such as during CPU hotplug with DETACH_GROUP. In that case the

sibling is removed from the context, while its file descriptor can still

keep it alive.

A typical failing sequence is:

- A group contains leader L and sibling S.

- CPU hot-unplug detaches S with DETACH_GROUP, removing it from

L->sibling_list but leaving S->group_leader == L.

- L is late

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References