CVE-2026-74753: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-74753 Overview

CVE-2026-74753 is a use-after-free vulnerability in the Linux kernel perf subsystem. The flaw resides in how perf_event_open() validates group leader events. The kernel's early validation rejects only REVOKED and DEAD events, allowing events in the EXIT state to be accepted as group leaders. A local attacker can attach a new sibling to a detached, exited leader. When the leader closes, the sibling retains a dangling group_leader pointer to freed memory.

Critical Impact
Local attackers with the ability to open perf events can trigger a use-after-free in kernel memory, enabling privilege escalation to root on affected Linux kernel builds.

Affected Products

Linux kernel (upstream, versions preceding commits 7a03413f31c1, 7ce010275c53, and fa091f46c383)
Linux distributions shipping vulnerable kernel builds with perf_event_open accessible to unprivileged users
Systems where kernel.perf_event_paranoid allows non-root access to performance events

Discovery Timeline

2026-08-26 - CVE-2026-74753 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-74753

Vulnerability Analysis

The Linux kernel's perf subsystem manages performance monitoring events that can be organized into groups sharing a common leader. The function perf_event_remove_on_exec() transitions remove-on-exec events into the EXIT state and detaches their group relationships when the target task performs an execve(). However, the associated file descriptor can remain open in the calling process.

When a caller invokes perf_event_open() with that descriptor as the group leader, the early validation path rejects only events in the REVOKED or DEAD states. Exited events pass validation. The kernel then links a new sibling to the detached leader. On subsequent closure of the leader, perf_group_detach() inspects the PERF_ATTACH_GROUP bit, finds it already cleared, and skips cleanup of the newly attached sibling. The sibling is left holding a group_leader pointer to freed kernel memory.

Root Cause

The root cause is incomplete state validation in perf_event_open(). The check enumerates disallowed states rather than allowlisting valid ones, omitting the EXIT state introduced by remove-on-exec semantics. The lack of coverage creates a window in which a stale, detached leader remains reachable through an open file descriptor and can be reattached to a fresh sibling.

Attack Vector

Exploitation requires local, low-privilege access to a system that permits perf_event_open() calls. The attacker creates a remove-on-exec event, triggers an exec in the target task to move the event into the EXIT state, then opens a new perf event referencing the retained file descriptor as the group leader. Closing the leader while the new sibling is attached produces the dangling pointer condition. Subsequent operations on the sibling dereference freed memory, which an attacker can shape to hijack kernel control flow.

The upstream fix rejects group leaders in the EXIT state and performs the check while holding the shared context mutex. Holding the mutex prevents a concurrent exec from transitioning the leader between validation and group attachment. See the fix commits 7a03413, 7ce01027, and fa091f46 for the authoritative source changes.

Detection Methods for CVE-2026-74753

Indicators of Compromise

Unexpected kernel oopses or general protection fault messages referencing perf_group_detach, perf_event_open, or _free_event in dmesg and /var/log/kern.log
Local processes issuing perf_event_open() syscalls with PERF_FLAG_FD_OUTPUT or group leader descriptors immediately after target tasks call execve()
Unexplained SLUB/SLAB allocator warnings such as BUG: KASAN: use-after-free naming the perf_event cache

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) in test environments to surface the use-after-free before production impact
Audit invocations of perf_event_open() using auditd with a syscall rule and correlate against recent execve() events from the same UID
Monitor for privilege escalation patterns following perf syscall activity, including unexpected UID transitions or new root-owned processes

Monitoring Recommendations

Alert on any local user process making perf_event_open() calls when kernel.perf_event_paranoid is set below 2
Track kernel crash telemetry across the fleet and correlate stack traces containing perf_event symbols
Baseline expected perf tooling users (perf, profilers, observability agents) and flag deviations

How to Mitigate CVE-2026-74753

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in commits 7a03413f31c1, 7ce010275c53, and fa091f46c383 or install vendor kernel updates that incorporate them
Restrict access to perf_event_open() by setting kernel.perf_event_paranoid to 3 where supported, or 2 at minimum
Prioritize patching multi-tenant hosts, developer workstations, and container hosts where untrusted local code executes

Patch Information

The fix rejects group leaders in the EXIT state during perf_event_open() validation and moves the check under the shared context mutex to close the race with concurrent exec. Distribution kernels including patched builds from Debian, Ubuntu, Red Hat, SUSE, and Oracle should be applied as they become available. Reboot is required for the new kernel to take effect.

Workarounds

Set kernel.perf_event_paranoid=3 via sysctl to disallow unprivileged use of perf_event_open() until the kernel is patched
Remove the CAP_PERFMON and CAP_SYS_ADMIN capabilities from untrusted workloads and container profiles
In containerized environments, ensure seccomp profiles block the perf_event_open syscall for unprivileged workloads

bash

# Configuration example
# Restrict perf_event_open to root only until patched kernel is deployed
sudo sysctl -w kernel.perf_event_paranoid=3
echo 'kernel.perf_event_paranoid = 3' | sudo tee /etc/sysctl.d/99-cve-2026-74753.conf
sudo sysctl --system

# Verify running kernel version after patching and reboot
uname -r