{"id":"CVE-2026-98552","kind":"vulnerability","aliases":["CVE-2026-98552"],"related":[],"title":"Linux kernel perf: refcount leak in attach_perf_ctx_data race","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nperf/core: Fix a refcount leak in attach_perf_ctx_data()\n\nThe attach_perf_ctx_data() can race on global and !global cases.  The\nglobal case is protected by global_ctx_data_rwsem and shares a single\nreference count using perf_ctx_data.global field.\n\nBut when it races with !global case, it may miss to set the global field\nand result in a reference count leak.\n\n CPU1                                  CPU2\n ----------------------------------------------------------------\n attach_task_ctx_data(.global=1)       attach_task_ctx_data(.global=0)\n   cd1 = alloc_perf_ctx_data();          cd2 = alloc_perf_ctx_data();\n                                         //    { .global = 0, .refcount = 1 };\n\n                                         try_cmpxchg(); // success,\n                                         // task->perf_ctx_data = cd2\n   try_cmpxhg(); // fail; old = cd2\n   refcount_inc_not_zero(&old->refcount); // success\n     // old.refcount = 2\n   free_perf_ctx_data(cd1);\n\nThen later detach_global_ctx_data() will see the data but it's not\nmarked as global, so it won't call detach_task_ctx_data().","summary":"A race between global and per-task perf context attachment in the Linux kernel's perf subsystem can leak a reference count. The sources describe a resource leak and do not state any code execution or data exposure.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kernel","linux","perf","runtime"],"not_affected_if":[],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-18T16:17:07+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:23:29+00:00","updated_at":"2026-10-25T05:23:29+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-25T05:23:29Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"Linux kernel perf: refcount leak in attach_perf_ctx_data race","impact":"low","summary":"A race between global and per-task perf context attachment in the Linux kernel's perf subsystem can leak a reference count. The sources describe a resource leak and do not state any code execution or data exposure.","category":"runtime","nicknames":[],"who_cares":["linux","kernel","perf"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; sources describe a reference count leak only","analyst_note":"Check the upstream kernel commit and the NVD entry for affected kernel version ranges and whether the leak can be triggered by unprivileged local users.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000531,"input_tokens":3633,"output_tokens":335,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98552':14A,17A '0':147C,159C '1':141C,161C '2':183C 'alloc':149C,154C 'attach':7A,32B,77C,82C,136C,142C 'call':210C 'case':92C,95C,118C 'cd1':148C,188C 'cd2':153C,169C,174C 'cmpxchg':163C 'cmpxhg':171C 'code':56B 'context':31B 'count':44B,108C,132C 'cpu1':134C 'cpu2':135C 'ctx':9A,79C,84C,100C,138C,144C,151C,156C,167C,186C,193C,213C 'cve':12A,15A 'data':10A,59B,80C,85C,101C,139C,145C,152C,157C,168C,187C,194C,198C,214C 'describ':47B 'detach':191C,211C 'execut':57B 'exposur':60B 'fail':172C 'field':111C,126C 'fix':72C 'follow':66C 'free':184C 'global':25B,89C,91C,94C,99C,117C,125C,140C,146C,158C,192C,205C 'inc':176C 'kernel':2A,18B,36B,64C 'later':190C 'leak':5A,41B,50B,75C,133C 'linux':1A,19B,35B,63C 'mark':203C 'may':120C 'miss':121C 'old':173C,179C 'old.refcount':182C 'per':28B 'per-task':27B 'perf':3A,8A,20B,30B,38B,78C,83C,150C,155C,166C,185C 'perf/core':71C 'perf_ctx_data.global':110C 'protect':97C 'race':11A,23B,87C,115C 'refcount':4A,74C,160C,175C,180C 'refer':43B,107C,131C 'resolv':70C 'resourc':49B 'result':128C 'runtim':21B 'rwsem':102C 'see':196C 'set':123C 'share':104C 'singl':106C 'sourc':46B 'state':54B 'subsystem':39B 'success':164C,181C 'task':29B,137C,143C,165C,212C 'tri':162C,170C 'use':109C 'vulner':67C 'won':208C 'zero':178C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:07+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98552","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98552","severity":null,"published_at":"2026-10-18T16:17:07+00:00","modified_at":"2026-10-19T10:19:11+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}