Linux kernel perf/core: use-after-free on a freed group leader after a sibling is detached during CPU hotplug

Impact

When a sibling perf event is detached with DETACH_GROUP - the CPU hot-unplug path - it is removed from the leader's sibling_list but keeps a group_leader pointer at the old leader. If the leader is then closed and freed while the sibling stays alive through its file descriptor, a PERF_IOC_FLAG_GROUP ioctl on the sibling follows the stale pointer into freed memory. The reproducer in the record is the perf fuzzer plus CPU hotplug plus load, and the trace shows a kernel paging fault in perf_ioctl. On a GPU node this is a local kernel use-after-free reachable by anyone permitted to open grouped perf events, which on fleets that relax perf_event_paranoid for profiling includes tenants; it becomes an availability and potential privilege-escalation risk on a shared node.

Who can reach it

Local user able to create perf event groups (governed by perf_event_paranoid and CAP_PERFMON) plus concurrent CPU hotplug activity. Not remote. On nodes where perf_event_paranoid is at the default restrictive setting and unprivileged perf is disabled, unprivileged tenants cannot reach it.

What to do

Apply the stable fix, which promotes a detached sibling to a singleton and corrects the __event_disable() cgroup accounting; three stable commits are listed. Rollout is a patched kernel and a per-node reboot, so drain GPU workloads first. As an interim measure, tightening kernel.perf_event_paranoid to disallow unprivileged perf removes tenant reachability.

References

Related entries

• Linux kernel IMA: integer underflow in xattr_verify() causes out-of-bounds read on truncated security.imaCVE-2026-74671 · Linux kernel IMA (xattr_verify digest-length check)Unscored
• Linux kernel mm/vmalloc: use-after-free when vmap huge-page promotion frees a page table under a concurrent ptdump walkCVE-2026-74672 · Linux kernel mm/vmalloc (huge vmap promotion vs ptdump page-table walk)Unscored
• Linux kernel mm: page-table reclaim flushes the wrong address, allowing reuse of a still-cached page tableCVE-2026-74674 · Linux kernel mm (zap_pte_range TLB flush address on direct page-table reclaim)Unscored
• Linux kernel vhost-scsi (VHOST_SET_FEATURES after endpoint setup): vhost_scsi_setup_vq_cmds() sizes each command'sCVE-2026-74702 · Linux kernel vhost-scsi (VHOST_SET_FEATURES after endpoint setup)Unscored
• Linux kernel vhost-scsi: malformed guest request with T10 protection bytes panics the hostCVE-2026-74703 · Linux kernel vhost-scsi (T10 PI scatterlist count validation)Unscored
• Linux kernel mlx5 vDPA: memory-region key creation reads past the firmware command bufferCVE-2026-74712 · Linux kernel mlx5_vdpa (create_direct_keys input buffer length)Unscored