The Linux kernel perf subsystem had a use-after-free vulnerability (CVE-2026-74637) caused by inconsistent handling of group leader and sibling detach operations. When a sibling is detached with DETACH_GROUP during CPU hotplug, it is removed from the leader's sibling list but retains a pointer to the now-freed leader. Subsequent ioctl calls dereference this stale pointer, causing kernel paging faults. The fix promotes detached siblings to singleton events and corrects cgroup accounting and event state changes to prevent use-after-free conditions.

Exploitation of this vulnerability can lead to kernel crashes (denial of service) due to dereferencing freed memory in the perf subsystem. There is no indication of privilege escalation or arbitrary code execution from the provided data. The impact is limited to system stability and reliability during perf event operations, especially under CPU hotplug scenarios.

A fix has been implemented in the Linux kernel to address this use-after-free vulnerability by promoting detached siblings to singleton events and correcting event state handling. Users should update to a Linux kernel version that includes this fix. Patch status is not explicitly stated in the provided data; check the official Linux kernel advisories or vendor updates for the exact fixed versions and apply updates accordingly.