{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "2e498d0a74e5b88a6689ae1b811f247f91ff188e"
            },
            {
              "fixed": "4cdb1b3ab96eb1b7eb70bc5c82fede334bd60df2"
            },
            {
              "fixed": "39358e856fb89e62e3c8d7389a2dc4ec33dbe90e"
            },
            {
              "fixed": "a2d5d3ee7b6e3953114726b1521e62123ab5b043"
            },
            {
              "fixed": "06ccef0434e98058ddae7bcebc901f93d22b7653"
            },
            {
              "fixed": "037a3c43edfb597665dd34457cd22b14692f2ba3"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.13.0"
            },
            {
              "fixed": "6.6.145"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.7.0"
            },
            {
              "fixed": "6.12.96"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.13.0"
            },
            {
              "fixed": "6.18.39"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.19.0"
            },
            {
              "fixed": "7.1.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64556.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/core: Detach event groups during remove_on_exec\n\nperf_event_remove_on_exec() removes events by calling\nperf_event_exit_event(). For top-level events, this removes the event from\nthe context with DETACH_EXIT only.\n\nThis can leave inconsistent group state when a removed event is a group\nleader and the group contains siblings without remove_on_exec. If the group\nwas active, the surviving siblings can remain active and attached to the\nremoved leader's sibling list, but are no longer represented by a valid\ngroup leader on the PMU context active lists.\n\nA later close of the removed leader uses DETACH_GROUP and can promote the\nstill-active siblings from this stale group state. The next schedule-in can\nthen add an already-linked active_list entry again, corrupting the PMU\ncontext active list.\n\nWith DEBUG_LIST enabled, this is caught as a list_add double-add in\nmerge_sched_in().\n\nFix this by detaching group relationships when remove_on_exec removes an\nevent. This preserves the existing task-exit and revoke behavior, while\nensuring surviving siblings are ungrouped before the removed event leaves\nthe context.",
  "id": "CVE-2026-64556",
  "modified": "2026-08-18T03:31:06.717329118Z",
  "published": "2026-07-29T08:01:46.864Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/037a3c43edfb597665dd34457cd22b14692f2ba3"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/06ccef0434e98058ddae7bcebc901f93d22b7653"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/39358e856fb89e62e3c8d7389a2dc4ec33dbe90e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/4cdb1b3ab96eb1b7eb70bc5c82fede334bd60df2"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a2d5d3ee7b6e3953114726b1521e62123ab5b043"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64556.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64556"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "perf/core: Detach event groups during remove_on_exec"
}