CVE-2026-74637 (GCVE-0-2026-74637)

Vulnerability from cvelistv5 – Published: 2026-08-22 15:32 – Updated: 2026-08-27 12:39
VLAI
Title
perf/core: Fix group leader use-after-free after sibling detach
Summary
In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix group leader use-after-free after sibling detach perf_group_detach() handles leader and sibling detach differently. When the group leader is detached, all siblings are promoted to singleton events and their group_leader pointer is reset to themselves. When a sibling is detached, it is removed from the leader's sibling_list, but its group_leader pointer is left pointing at the old leader. That is harmless when the sibling is being closed and freed immediately, as in the DETACH_DEAD path. It is not safe when the sibling is detached but kept alive, such as during CPU hotplug with DETACH_GROUP. In that case the sibling is removed from the context, while its file descriptor can still keep it alive. A typical failing sequence is: - A group contains leader L and sibling S. - CPU hot-unplug detaches S with DETACH_GROUP, removing it from L->sibling_list but leaving S->group_leader == L. - L is later closed and freed. - A PERF_IOC_FLAG_GROUP ioctl on S follows S->group_leader and dereferences the freed leader. This was reproduced by running the perf event fuzzer, CPU hotplug, and a stress workload concurrently: Unable to handle kernel paging request at virtual address 006b6b6b6b6b6cdb CPU: 2 PID: 12489 Comm: perf_fuzzer 6.18.7 PREEMPT pc : perf_ioctl+0x34c/0xc68 x20: ffffff89a3fa2c70 x8 : 6b6b6b6b6b6b6b6b Code: 943c4a0e 340047a0 f9404a94 f9411e88 (f940b908) Call trace: perf_ioctl+0x34c/0xc68 (P) __arm64_sys_ioctl+0xa0/0xf4 invoke_syscall+0x58/0xe4 el0_svc_common+0xa8/0xdc do_el0_svc+0x1c/0x28 el0_svc+0x40/0xc0 el0t_64_sync_handler+0x68/0xdc el0t_64_sync+0x1c4/0x1c8 The fault happened in perf_ioctl(), where perf_event_for_each() follows the stale group_leader pointer and perf_event_for_each_child() then dereferences the freed leader's context. Fix the use-after-free by promoting the detached sibling to a singleton. Also fix __event_disable() cgroup accounting and event state change.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 8a49542c0554af7d0073aac0ee73ee65b807ef34 , < 8f867c0e8da4c2303d91adf45acb6b1820966c27 (git)
Affected: 8a49542c0554af7d0073aac0ee73ee65b807ef34 , < 8e92e03984364d93e0d5b0acd81c95eca773f034 (git)
Affected: 8a49542c0554af7d0073aac0ee73ee65b807ef34 , < f8a07021679aadfb6d63b209207ccc41f26982d1 (git)
Affected: 8a49542c0554af7d0073aac0ee73ee65b807ef34 , < 80c6054a4c40a0ffad82acef9f9a0dee108d152a (git)
Affected: 8a49542c0554af7d0073aac0ee73ee65b807ef34 , < b42948f9e0d1ea4dbd5742ce1dfc7688de5d4a35 (git)
Affected: 8a49542c0554af7d0073aac0ee73ee65b807ef34 , < a979a642402d0b1f856c7a729b4cb2d92de4cf2f (git)
Affected: 8a49542c0554af7d0073aac0ee73ee65b807ef34 , < 1e7abfeb23c12bf46f6457e4a3e1a1a300d50619 (git)
Affected: 8a49542c0554af7d0073aac0ee73ee65b807ef34 , < 42c5ca1f0a288a52878bd72a5595b08261057438 (git)
Affected: e732ebc42aea321ee84514330eb3a675307fcc83 (git)
Affected: 2.6.34.14 , < 2.6.35 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.35
Unaffected: 0 , < 2.6.35 (semver)
Unaffected: 5.10.267 , ≤ 5.10.* (semver)
Unaffected: 5.15.218 , ≤ 5.15.* (semver)
Unaffected: 6.1.185 , ≤ 6.1.* (semver)
Unaffected: 6.6.154 , ≤ 6.6.* (semver)
Unaffected: 6.12.105 , ≤ 6.12.* (semver)
Unaffected: 6.18.45 , ≤ 6.18.* (semver)
Unaffected: 7.1.9 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/events/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8f867c0e8da4c2303d91adf45acb6b1820966c27",
              "status": "affected",
              "version": "8a49542c0554af7d0073aac0ee73ee65b807ef34",
              "versionType": "git"
            },
            {
              "lessThan": "8e92e03984364d93e0d5b0acd81c95eca773f034",
              "status": "affected",
              "version": "8a49542c0554af7d0073aac0ee73ee65b807ef34",
              "versionType": "git"
            },
            {
              "lessThan": "f8a07021679aadfb6d63b209207ccc41f26982d1",
              "status": "affected",
              "version": "8a49542c0554af7d0073aac0ee73ee65b807ef34",
              "versionType": "git"
            },
            {
              "lessThan": "80c6054a4c40a0ffad82acef9f9a0dee108d152a",
              "status": "affected",
              "version": "8a49542c0554af7d0073aac0ee73ee65b807ef34",
              "versionType": "git"
            },
            {
              "lessThan": "b42948f9e0d1ea4dbd5742ce1dfc7688de5d4a35",
              "status": "affected",
              "version": "8a49542c0554af7d0073aac0ee73ee65b807ef34",
              "versionType": "git"
            },
            {
              "lessThan": "a979a642402d0b1f856c7a729b4cb2d92de4cf2f",
              "status": "affected",
              "version": "8a49542c0554af7d0073aac0ee73ee65b807ef34",
              "versionType": "git"
            },
            {
              "lessThan": "1e7abfeb23c12bf46f6457e4a3e1a1a300d50619",
              "status": "affected",
              "version": "8a49542c0554af7d0073aac0ee73ee65b807ef34",
              "versionType": "git"
            },
            {
              "lessThan": "42c5ca1f0a288a52878bd72a5595b08261057438",
              "status": "affected",
              "version": "8a49542c0554af7d0073aac0ee73ee65b807ef34",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e732ebc42aea321ee84514330eb3a675307fcc83",
              "versionType": "git"
            },
            {
              "lessThan": "2.6.35",
              "status": "affected",
              "version": "2.6.34.14",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/events/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.35"
            },
            {
              "lessThan": "2.6.35",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.267",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.218",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.185",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.154",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.267",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.218",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.185",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.154",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.105",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "2.6.34.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/core: Fix group leader use-after-free after sibling detach\n\nperf_group_detach() handles leader and sibling detach differently. When the\ngroup leader is detached, all siblings are promoted to singleton events and\ntheir group_leader pointer is reset to themselves. When a sibling is\ndetached, it is removed from the leader\u0027s sibling_list, but its\ngroup_leader pointer is left pointing at the old leader.\n\nThat is harmless when the sibling is being closed and freed immediately, as\nin the DETACH_DEAD path. It is not safe when the sibling is detached but\nkept alive, such as during CPU hotplug with DETACH_GROUP. In that case the\nsibling is removed from the context, while its file descriptor can still\nkeep it alive.\n\nA typical failing sequence is:\n\n  - A group contains leader L and sibling S.\n  - CPU hot-unplug detaches S with DETACH_GROUP, removing it from\n    L-\u003esibling_list but leaving S-\u003egroup_leader == L.\n  - L is later closed and freed.\n  - A PERF_IOC_FLAG_GROUP ioctl on S follows S-\u003egroup_leader and\n    dereferences the freed leader.\n\nThis was reproduced by running the perf event fuzzer, CPU hotplug, and a\nstress workload concurrently:\n\n  Unable to handle kernel paging request at virtual address 006b6b6b6b6b6cdb\n  CPU: 2 PID: 12489 Comm: perf_fuzzer 6.18.7 PREEMPT\n  pc : perf_ioctl+0x34c/0xc68\n  x20: ffffff89a3fa2c70 x8 : 6b6b6b6b6b6b6b6b\n  Code: 943c4a0e 340047a0 f9404a94 f9411e88 (f940b908)\n  Call trace:\n  perf_ioctl+0x34c/0xc68 (P)\n  __arm64_sys_ioctl+0xa0/0xf4\n  invoke_syscall+0x58/0xe4\n  el0_svc_common+0xa8/0xdc\n  do_el0_svc+0x1c/0x28\n  el0_svc+0x40/0xc0\n  el0t_64_sync_handler+0x68/0xdc\n  el0t_64_sync+0x1c4/0x1c8\n\nThe fault happened in perf_ioctl(), where perf_event_for_each() follows\nthe stale group_leader pointer and perf_event_for_each_child() then\ndereferences the freed leader\u0027s context.\n\nFix the use-after-free by promoting the detached sibling to a singleton.\nAlso fix __event_disable() cgroup accounting and event state change."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through local perf_event_open(2), ioctl(2) on perf fds (PERF_IOC_FLAG_GROUP), close(2), and execve(2); perf_ioctl() follows the stale group_leader into freed memory. There is no network, adjacent-wireless, or physical device entry path.\nAC:L - An attacker fully controls creation of leader/sibling groups, triggering sibling DETACH_GROUP via remove_on_exec or racing CPU hot-unplug against leader close, then issuing GROUP ioctls on the surviving sibling fd. The reproducer used perf_fuzzer with concurrent hotplug, and the attacker controls both sides of the lifecycle race.\nPR:L - A basic unprivileged local user can open per-task perf event groups on their own process with exclude_kernel=1 under the default sysctl_perf_event_paranoid=2, without CAP_PERFMON or init-namespace root. security_perf_event_open(PERF_SECURITY_OPEN) and perf_check_permission() allow this self-monitoring path.\nUI:N - Exploitation requires no action from another user or administrator beyond the attacker running their own syscalls (open group, exec or wait for hotplug, close leader, ioctl sibling). No victim must mount filesystems, open files, or interact with the system.\nS:U - Impact is confined to kernel perf/core heap corruption and privilege escalation within the same host kernel security authority. This is not a VM escape, IOMMU bypass, or cross-namespace boundary change; it is standard local kernel memory corruption.\nC:H - This is a use-after-free: perf_event_for_each() and perf_event_for_each_child() dereference a freed group leader and its context (repro showed 0x6b6b6b6b6b6b6b poisoned pointers). UAF on attacker-influenceable perf_event objects enables arbitrary kernel memory disclosure via controlled reallocations.\nI:H - Freed perf_event/group_leader structures can be reallocated with attacker-controlled data, providing heap grooming primitives for arbitrary kernel writes and control-flow hijack. Memory corruption from following stale group_leader pointers is exploitable beyond a simple crash.\nA:H - The fix commit documents a reproducible kernel paging fault in perf_ioctl() (\"Unable to handle kernel paging request\"). UAF dereferences reliably cause kernel oops/panic or hang, giving full denial of service and potential system-wide unavailability on affected hosts."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T12:39:51.869Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8f867c0e8da4c2303d91adf45acb6b1820966c27"
        },
        {
          "url": "https://git.kernel.org/stable/c/8e92e03984364d93e0d5b0acd81c95eca773f034"
        },
        {
          "url": "https://git.kernel.org/stable/c/f8a07021679aadfb6d63b209207ccc41f26982d1"
        },
        {
          "url": "https://git.kernel.org/stable/c/80c6054a4c40a0ffad82acef9f9a0dee108d152a"
        },
        {
          "url": "https://git.kernel.org/stable/c/b42948f9e0d1ea4dbd5742ce1dfc7688de5d4a35"
        },
        {
          "url": "https://git.kernel.org/stable/c/a979a642402d0b1f856c7a729b4cb2d92de4cf2f"
        },
        {
          "url": "https://git.kernel.org/stable/c/1e7abfeb23c12bf46f6457e4a3e1a1a300d50619"
        },
        {
          "url": "https://git.kernel.org/stable/c/42c5ca1f0a288a52878bd72a5595b08261057438"
        }
      ],
      "title": "perf/core: Fix group leader use-after-free after sibling detach",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74637",
    "datePublished": "2026-08-22T15:32:16.755Z",
    "dateReserved": "2026-08-15T05:44:03.922Z",
    "dateUpdated": "2026-08-27T12:39:51.869Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74637",
      "date": "2026-08-29",
      "epss": "0.00126",
      "percentile": "0.02532"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-24T14:46:17.000Z",
      "cve": "CVE-2026-74637",
      "id": "msrc_CVE-2026-74637",
      "initial_release_date": "2026-08-24T01:01:44.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "perf/core: Fix group leader use-after-free after sibling detach",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74637.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74637\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-22T16:16:36.890\",\"lastModified\":\"2026-08-27T13:18:35.347\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nperf/core: Fix group leader use-after-free after sibling detach\\n\\nperf_group_detach() handles leader and sibling detach differently. When the\\ngroup leader is detached, all siblings are promoted to singleton events and\\ntheir group_leader pointer is reset to themselves. When a sibling is\\ndetached, it is removed from the leader\u0027s sibling_list, but its\\ngroup_leader pointer is left pointing at the old leader.\\n\\nThat is harmless when the sibling is being closed and freed immediately, as\\nin the DETACH_DEAD path. It is not safe when the sibling is detached but\\nkept alive, such as during CPU hotplug with DETACH_GROUP. In that case the\\nsibling is removed from the context, while its file descriptor can still\\nkeep it alive.\\n\\nA typical failing sequence is:\\n\\n  - A group contains leader L and sibling S.\\n  - CPU hot-unplug detaches S with DETACH_GROUP, removing it from\\n    L-\u003esibling_list but leaving S-\u003egroup_leader == L.\\n  - L is later closed and freed.\\n  - A PERF_IOC_FLAG_GROUP ioctl on S follows S-\u003egroup_leader and\\n    dereferences the freed leader.\\n\\nThis was reproduced by running the perf event fuzzer, CPU hotplug, and a\\nstress workload concurrently:\\n\\n  Unable to handle kernel paging request at virtual address 006b6b6b6b6b6cdb\\n  CPU: 2 PID: 12489 Comm: perf_fuzzer 6.18.7 PREEMPT\\n  pc : perf_ioctl+0x34c/0xc68\\n  x20: ffffff89a3fa2c70 x8 : 6b6b6b6b6b6b6b6b\\n  Code: 943c4a0e 340047a0 f9404a94 f9411e88 (f940b908)\\n  Call trace:\\n  perf_ioctl+0x34c/0xc68 (P)\\n  __arm64_sys_ioctl+0xa0/0xf4\\n  invoke_syscall+0x58/0xe4\\n  el0_svc_common+0xa8/0xdc\\n  do_el0_svc+0x1c/0x28\\n  el0_svc+0x40/0xc0\\n  el0t_64_sync_handler+0x68/0xdc\\n  el0t_64_sync+0x1c4/0x1c8\\n\\nThe fault happened in perf_ioctl(), where perf_event_for_each() follows\\nthe stale group_leader pointer and perf_event_for_each_child() then\\ndereferences the freed leader\u0027s context.\\n\\nFix the use-after-free by promoting the detached sibling to a singleton.\\nAlso fix __event_disable() cgroup accounting and event state change.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"kernel/events/core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"8a49542c0554af7d0073aac0ee73ee65b807ef34\",\"lessThan\":\"8f867c0e8da4c2303d91adf45acb6b1820966c27\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8a49542c0554af7d0073aac0ee73ee65b807ef34\",\"lessThan\":\"8e92e03984364d93e0d5b0acd81c95eca773f034\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8a49542c0554af7d0073aac0ee73ee65b807ef34\",\"lessThan\":\"f8a07021679aadfb6d63b209207ccc41f26982d1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8a49542c0554af7d0073aac0ee73ee65b807ef34\",\"lessThan\":\"80c6054a4c40a0ffad82acef9f9a0dee108d152a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8a49542c0554af7d0073aac0ee73ee65b807ef34\",\"lessThan\":\"b42948f9e0d1ea4dbd5742ce1dfc7688de5d4a35\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8a49542c0554af7d0073aac0ee73ee65b807ef34\",\"lessThan\":\"a979a642402d0b1f856c7a729b4cb2d92de4cf2f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8a49542c0554af7d0073aac0ee73ee65b807ef34\",\"lessThan\":\"1e7abfeb23c12bf46f6457e4a3e1a1a300d50619\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8a49542c0554af7d0073aac0ee73ee65b807ef34\",\"lessThan\":\"42c5ca1f0a288a52878bd72a5595b08261057438\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e732ebc42aea321ee84514330eb3a675307fcc83\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2.6.34.14\",\"lessThan\":\"2.6.35\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"kernel/events/core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.35\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.35\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.267\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.218\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.185\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.154\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.105\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.45\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.9\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1e7abfeb23c12bf46f6457e4a3e1a1a300d50619\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/42c5ca1f0a288a52878bd72a5595b08261057438\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/80c6054a4c40a0ffad82acef9f9a0dee108d152a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8e92e03984364d93e0d5b0acd81c95eca773f034\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8f867c0e8da4c2303d91adf45acb6b1820966c27\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a979a642402d0b1f856c7a729b4cb2d92de4cf2f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b42948f9e0d1ea4dbd5742ce1dfc7688de5d4a35\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f8a07021679aadfb6d63b209207ccc41f26982d1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-25T08:52:41+00:00",
      "cve": "CVE-2026-74637",
      "id": "CVE-2026-74637",
      "initial_release_date": "2026-08-22T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: perf/core: Fix group leader use-after-free after sibling detach",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74637.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.