CVE-2026-98552

A flaw was found in the Linux kernel's Performance Counters for Linux (perf) subsystem. A race condition during the attachment of performance monitoring context data can cause the kernel to fail to update tracking flags, resulting in a reference count leak. A local attacker could exploit this vulnerability to prevent allocated kernel memory from being released, potentially leading to memory exhaustion and a denial of service (DoS).

This vulnerability is evaluated as Low severity because triggering the race condition requires authenticated local access, specific timing preconditions, and only causes a gradual leakage of kernel memory without enabling code execution or privilege escalation. Older distributions including Red Hat Enterprise Linux 8 and 9 do not include the affected context attachment logic and remain unaffected. In environments where this code is present, substantial and sustained local activity would be required to induce a system-wide denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.