CVE-2026-74637

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> perf/core: Fix group leader use-after-free after sibling detach<br /> <br /> perf_group_detach() handles leader and sibling detach differently. When the<br /> group leader is detached, all siblings are promoted to singleton events and<br /> their group_leader pointer is reset to themselves. When a sibling is<br /> detached, it is removed from the leader&amp;#39;s sibling_list, but its<br /> group_leader pointer is left pointing at the old leader.<br /> <br /> That is harmless when the sibling is being closed and freed immediately, as<br /> in the DETACH_DEAD path. It is not safe when the sibling is detached but<br /> kept alive, such as during CPU hotplug with DETACH_GROUP. In that case the<br /> sibling is removed from the context, while its file descriptor can still<br /> keep it alive.<br /> <br /> A typical failing sequence is:<br /> <br /> - A group contains leader L and sibling S.<br /> - CPU hot-unplug detaches S with DETACH_GROUP, removing it from<br /> L-&gt;sibling_list but leaving S-&gt;group_leader == L.<br /> - L is later closed and freed.<br /> - A PERF_IOC_FLAG_GROUP ioctl on S follows S-&gt;group_leader and<br /> dereferences the freed leader.<br /> <br /> This was reproduced by running the perf event fuzzer, CPU hotplug, and a<br /> stress workload concurrently:<br /> <br /> Unable to handle kernel paging request at virtual address 006b6b6b6b6b6cdb<br /> CPU: 2 PID: 12489 Comm: perf_fuzzer 6.18.7 PREEMPT<br /> pc : perf_ioctl+0x34c/0xc68<br /> x20: ffffff89a3fa2c70 x8 : 6b6b6b6b6b6b6b6b<br /> Code: 943c4a0e 340047a0 f9404a94 f9411e88 (f940b908)<br /> Call trace:<br /> perf_ioctl+0x34c/0xc68 (P)<br /> __arm64_sys_ioctl+0xa0/0xf4<br /> invoke_syscall+0x58/0xe4<br /> el0_svc_common+0xa8/0xdc<br /> do_el0_svc+0x1c/0x28<br /> el0_svc+0x40/0xc0<br /> el0t_64_sync_handler+0x68/0xdc<br /> el0t_64_sync+0x1c4/0x1c8<br /> <br /> The fault happened in perf_ioctl(), where perf_event_for_each() follows<br /> the stale group_leader pointer and perf_event_for_each_child() then<br /> dereferences the freed leader&amp;#39;s context.<br /> <br /> Fix the use-after-free by promoting the detached sibling to a singleton.<br /> Also fix __event_disable() cgroup accounting and event state change.