CVE-2026-74637: Linux Kernel Use-After-Free Vulnerability

CVE-2026-74637 Overview

CVE-2026-74637 is a use-after-free vulnerability in the Linux kernel's perf/core subsystem. The flaw resides in perf_group_detach(), which handles group leader and sibling detach operations asymmetrically. When a sibling event is detached with DETACH_GROUP during CPU hot-unplug, it is removed from the leader's sibling_list but retains a stale group_leader pointer. If the leader is subsequently closed and freed, a later PERF_IOC_FLAG_GROUP ioctl on the surviving sibling dereferences freed memory. A local user with permission to open perf events can trigger the condition and corrupt kernel memory.

Critical Impact
A local, low-privileged attacker can trigger a kernel use-after-free through the perf event ioctl interface, enabling privilege escalation or denial of service on affected Linux hosts.

Affected Products

Linux kernel perf/core subsystem (upstream)
Stable Linux kernel branches receiving backports referenced in the kernel.org commits
Distributions shipping kernels prior to the fix commits (for example 1e7abfeb23c1, 42c5ca1f0a28, 8f867c0e8da4)

Discovery Timeline

2026-08-22 - CVE-2026-74637 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-74637

Vulnerability Analysis

The defect is a classic use-after-free triggered by inconsistent bookkeeping between two paths inside perf_group_detach(). When the group leader is detached, all siblings are promoted to singleton events and their group_leader pointer is reset to themselves. When only a sibling is detached, it is removed from the leader's sibling_list, but the sibling's group_leader pointer continues to reference the original leader.

This mismatch is safe when the sibling is being destroyed immediately, as in the DETACH_DEAD path. It becomes unsafe under DETACH_GROUP during CPU hotplug, where the sibling is removed from the context but kept alive by an open file descriptor. Once the leader is later closed and freed, the sibling still points to freed memory. A subsequent PERF_IOC_FLAG_GROUP ioctl invokes perf_event_for_each(), which walks group_leader, and perf_event_for_each_child() then dereferences the freed leader's context.

The reported crash shows the poisoned slab pattern 0x6b6b6b6b6b6b6b6b in register x8 and a fault inside perf_ioctl+0x34c/0xc68, confirming access to freed kernel objects.

Root Cause

The root cause is asymmetric state management in perf_group_detach(). Siblings kept alive after a DETACH_GROUP operation are never converted to singletons, leaving a dangling group_leader reference. The fix promotes the detached sibling to a singleton in the surviving path and also corrects __event_disable() cgroup accounting and event state transitions.

Attack Vector

Exploitation requires local access with permission to create perf events, which is governed by the perf_event_paranoid sysctl. The reproducer combined the perf event fuzzer, CPU hotplug operations, and a concurrent stress workload. An attacker can script a similar sequence: open a group leader and sibling, trigger CPU hot-unplug or another DETACH_GROUP path on the sibling, close the leader, then issue an ioctl with PERF_IOC_FLAG_GROUP on the sibling. Successful exploitation yields kernel memory corruption, which is a common precursor to local privilege escalation.

No verified proof-of-concept code has been published for this issue. See the kernel.org fix commit 1e7abfeb23c1 for the authoritative patch.

Detection Methods for CVE-2026-74637

Indicators of Compromise

Kernel oops or panic messages referencing perf_ioctl, perf_event_for_each, or perf_event_for_each_child in the call trace.
Faulting virtual addresses matching slab poison patterns such as 6b6b6b6b6b6b6b6b, indicating access to freed SLUB objects.
Unexpected process terminations of workloads issuing PERF_EVENT_IOC_* ioctls concurrently with CPU hotplug events.

Detection Strategies

Monitor dmesg and /var/log/kern.log for Unable to handle kernel paging request entries with perf_ioctl on the stack.
Use auditd rules on the perf_event_open syscall to identify unprivileged processes creating perf event groups, especially with sibling events.
Correlate perf event syscall activity with CPU online/offline transitions logged under /sys/devices/system/cpu/cpu*/online.

Monitoring Recommendations

Enable kernel crash collection (kdump, pstore) so post-crash analysis can attribute faults to perf/core.
Track running kernel versions across the fleet and alert on hosts still exposing the vulnerable perf_group_detach() code paths.
Baseline expected users of the perf subsystem and flag new local accounts or containers invoking perf_event_open at scale.

How to Mitigate CVE-2026-74637

Immediate Actions Required

Apply the upstream fix or a distribution kernel update that includes commit 1e7abfeb23c1 or its stable backports.
Restrict local access to untrusted users and containers on hosts running unpatched kernels.
Raise kernel.perf_event_paranoid to 3 where supported, denying unprivileged use of perf_event_open.

Patch Information

The fix promotes a detached sibling to a singleton, mirroring the leader-detach path, and repairs __event_disable() cgroup accounting and event state changes. Backports are available in multiple stable branches. Reference commits include 1e7abfeb23c1, 42c5ca1f0a28, 80c6054a4c40, 8e92e0398436, 8f867c0e8da4, a979a642402d, b42948f9e0d1, and f8a07021679a.

Workarounds

Set kernel.perf_event_paranoid=3 via sysctl to block unprivileged perf_event_open calls.
Drop CAP_PERFMON and CAP_SYS_ADMIN from container and workload security profiles where perf access is not required.
Avoid running CPU hotplug operations on multi-tenant hosts until patched kernels are deployed.

bash

# Configuration example
# Restrict unprivileged perf_event_open until the kernel is patched
sudo sysctl -w kernel.perf_event_paranoid=3
echo 'kernel.perf_event_paranoid=3' | sudo tee /etc/sysctl.d/99-cve-2026-74637.conf

# Verify running kernel and check for the fix commit in the changelog
uname -r
rpm -q --changelog kernel 2>/dev/null | grep -i 'perf_group_detach' || \
  dpkg-query -W -f='${Version}\n' linux-image-$(uname -r)