CVE-2026-98552
Received Received - Intake

Refcount Leak in Linux Kernel perf/core

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix a refcount leak in attach_perf_ctx_data() The attach_perf_ctx_data() can race on global and !global cases. The global case is protected by global_ctx_data_rwsem and shares a single reference count using perf_ctx_data.global field. But when it races with !global case, it may miss to set the global field and result in a reference count leak. CPU1 CPU2 ---------------------------------------------------------------- attach_task_ctx_data(.global=1) attach_task_ctx_data(.global=0) cd1 = alloc_perf_ctx_data(); cd2 = alloc_perf_ctx_data(); // { .global = 0, .refcount = 1 }; try_cmpxchg(); // success, // task->perf_ctx_data = cd2 try_cmpxhg(); // fail; old = cd2 refcount_inc_not_zero(&old->refcount); // success // old.refcount = 2 free_perf_ctx_data(cd1); Then later detach_global_ctx_data() will see the data but it's not marked as global, so it won't call detach_task_ctx_data().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98552
EUVD
EUVD-2026-103597

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
Linux Linux 506e64e710ff9573fd2b86686528762b7901b5e4
Linux Linux 506e64e710ff9573fd2b86686528762b7901b5e4
Linux Linux 506e64e710ff9573fd2b86686528762b7901b5e4
Linux Linux 6.15

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a refcount leak in the Linux kernel's perf/core subsystem. The attach_perf_ctx_data() function can race between global and non-global cases, causing a reference count to leak when the global field is not set properly during concurrent operations.

Impact Analysis

A refcount leak can lead to memory leaks, system instability, or crashes over time as resources are not properly released. This may cause performance degradation or unexpected system failures in systems using the affected kernel code.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for CVE-2026-98552 to address the refcount leak in attach_perf_ctx_data().

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98552. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart