VulnerabilityPublished 18 Oct 2026

CVE-2026-98552: Linux kernel · perf/core: Fix a refcount leak in attach_perf_ctx_data()

Source GCVE Database

Authoritative record:CVE-2026-98552· Medium

Not known to be exploited · fixed in cca4980630b3c7a85f53cb43c6018184ce5d4e37 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 12:55 UTC

Severity

Medium

Rated by Threat Radar · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 9% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in cca4980630b3c7a85f53cb43c6018184ce5d4e37, 23250517cd475367653f1e99396967f54c6f1b7c, 5286d4eb5cd7e10d7d93c3cc596e18bc8ad80f72

Exploitation evidence

Disclosed: evidence found.
CVE published 18 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-x3q4-wwr6-jh85

What to do

Upgrade Linux kernel to cca4980630b3c7a85f53cb43c6018184ce5d4e37, 23250517cd475367653f1e99396967f54c6f1b7c or 5286d4eb5cd7e10d7d93c3cc596e18bc8ad80f72.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 506e64e710ff9573fd2b86686528762b7901b5e4, < cca4980630b3c7a85f53cb43c6018184ce5d4e37	Fixed in cca4980630b3c7a85f53cb43c6018184ce5d4e37
LinuxLinux	Affected ≥ 506e64e710ff9573fd2b86686528762b7901b5e4, < 23250517cd475367653f1e99396967f54c6f1b7c	Fixed in 23250517cd475367653f1e99396967f54c6f1b7c
LinuxLinux	Affected ≥ 506e64e710ff9573fd2b86686528762b7901b5e4, < 5286d4eb5cd7e10d7d93c3cc596e18bc8ad80f72	Fixed in 5286d4eb5cd7e10d7d93c3cc596e18bc8ad80f72
LinuxLinux	Affected =6.15	Fixed in–

AI-suggested

A fix for this vulnerability has been implemented in the Linux kernel. Users and administrators should apply the official kernel updates that include this patch to resolve the refcount leak. Since no vendor advisory or patch links are provided here, consult the Linux kernel mailing lists or official kernel release notes for the specific patch and update instructions.

Description

A refcount leak vulnerability in the Linux kernel's perf subsystem was fixed in the attach_perf_ctx_data() function. The issue arises due to a race condition between global and non-global cases when attaching performance context data, potentially causing a reference count leak. This can lead to resource management issues within the kernel's performance monitoring infrastructure.

Impact

The impact is a reference count leak in the kernel's perf subsystem, which may cause resource leaks and potentially degrade system performance or stability over time. There is no indication of direct code execution or privilege escalation from this vulnerability. No known exploits in the wild have been reported.

Summary

The vulnerability in the Linux kernel's perf/core component involves a race condition in the attach_perf_ctx_data() function. The global case is protected by a read-write semaphore and shares a single reference count via the perf_ctx_data.global field. However, when racing with the non-global case, the global field may not be set correctly, resulting in a reference count leak. Specifically, concurrent execution on different CPUs can cause the reference count to be incremented incorrectly and the global flag to be missed, leading to improper cleanup and potential resource leaks.

References

Community reviews

Loading reviews…