CVE-2026-74637

A flaw was found in the Linux kernel's perf subsystem. A local attacker could exploit a use-after-free vulnerability when a perf event group's sibling is detached but remains active, and its pointer to the group leader is not properly updated. This improper handling can lead to a system crash, resulting in a Denial of Service (DoS).

A use after free in perf event group handling can occur when a sibling event is detached with DETACH_GROUP and kept alive while its group_leader pointer still references the old leader. If the old leader is later closed and freed, a local process can issue a PERF_IOC_FLAG_GROUP ioctl on the remaining sibling and perf_event_for_each can follow the stale group_leader pointer into freed memory. For the CVSS the PR:L is used because the attacker needs local access to perf event file descriptors and ioctl access, while full administrator privileges are not inherent to the vulnerable operation in permissive perf configurations. The issue is not network reachable. Impact is at least local denial of service via kernel crash and in the paranoid case may include privilege escalation due to a concrete kernel use after free race.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.