SB20260827120 - Use-after-free in Linux kernel events

Description

This security bulletin contains information about 1 vulnerability.

1) Use-after-free (CVE-ID: CVE-2026-74753)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to a use-after-free in perf_event_open() group handling in kernel/events/core.c when attaching a new event to a group leader in the EXIT state. A local user can open a perf event as a sibling of a detached leader to execute arbitrary code.

The issue occurs because a sibling event can retain a group_leader pointer to a freed event after remove-on-exec detaches the original leader.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/7a03413f31c196ab3894f988cdce0bb47b4fec42
• https://git.kernel.org/stable/c/7ce010275c531475f9d6e7efb11b9e522c74ed2e
• https://git.kernel.org/stable/c/fa091f46c3833fb22384f10eade2b4e1e1d0b278