CVE-2026-74753

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> perf: Reject exited events as group leaders<br /> <br /> perf_event_remove_on_exec() sets remove-on-exec events to the EXIT state<br /> and detaches their group relationships. The event&amp;#39;s file descriptor can<br /> remain open, however, and perf_event_open() currently accepts that event<br /> as a group leader because its early validation rejects only REVOKED and<br /> DEAD events.<br /> <br /> A new sibling can consequently be linked to the detached leader. When<br /> the leader is closed, perf_group_detach() observes that its<br /> PERF_ATTACH_GROUP bit is already clear and skips the new sibling. The<br /> sibling then retains a group_leader pointer to the freed event.<br /> <br /> Reject group leaders in the EXIT state. Perform the check while holding<br /> the shared context mutex so that an exec in the target task cannot detach<br /> the leader between validation and group attachment.<br /> <br /> [peterz: make the earlier test fully consistent]