CVE-2026-98552 perf/core: Fix a refcount leak in attach_perf_ctx_data()
A race condition in the Linux kernel's perf subsystem can cause a reference count leak, potentially leading to resource exhaustion and denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98552?
CVE-2026-98552 is a vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
perf/core: Fix a refcount leak in attach_perf_ctx_data()
The attach_perf_ctx_data() can race on global and !global cases. The global case is protected by global_ctx_data_rwsem and shares a single reference count using perf_ctx_data.global field.
But when it races with !global case, it may miss to set the global field and result in a reference count leak.
CPU1 CPU2 ---------------------------------------------------------------- attach_task_ctx_data(.global=1) attach_task_ctx_data(.global=0) cd1 = alloc_perf_ctx_data(); cd2 = alloc_perf_ctx_data(); // { .global = 0, .refcount = 1 };
try_cmpxchg(); // success, // task->perf_ctx_data = cd2 try_cmpxhg(); // fail; old = cd2 refcount_inc_not_zero(&old->refcount); // success // old.refcount = 2 free_perf_ctx_data(cd1);
Then later detach_global_ctx_data() will see the data but it's not marked as global, so it won't call detach_task_ctx_data().
Which versions are affected by CVE-2026-98552?
How do I fix CVE-2026-98552?
Apply the vendor's patch.
Is CVE-2026-98552 being exploited?
There is no known exploitation of CVE-2026-98552 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-98552, DEBIAN-CVE-2026-98552, GHSA-x3q4-wwr6-jh85, UBUNTU-CVE-2026-98552.