CVE-2026-98552

In the Linux kernel, the following vulnerability has been resolved:

perf/core: Fix a refcount leak in attach perf ctx data()

The attach perf ctx data() can race on global and !global cases. The global case is protected by global ctx data rwsem and shares a single reference count using perf ctx data.global field.

But when it races with !global case, it may miss to set the global field and result in a reference count leak.

attach task ctx data(.global=1) attach task ctx data(.global=0) cd1 = alloc perf ctx data(); cd2 = alloc perf ctx data(); // { .global = 0, .refcount = 1 };

                 try cmpxchg(); // success,
                 // task->perf ctx data = cd2

try cmpxhg(); // fail; old = cd2 refcount inc not zero(&old->refcount); // success // old.refcount = 2 free perf ctx data(cd1);

Then later detach global ctx data() will see the data but it's not marked as global, so it won't call detach task ctx data().