{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "506e64e710ff9573fd2b86686528762b7901b5e4"
            },
            {
              "fixed": "23250517cd475367653f1e99396967f54c6f1b7c"
            },
            {
              "fixed": "5286d4eb5cd7e10d7d93c3cc596e18bc8ad80f72"
            },
            {
              "fixed": "cca4980630b3c7a85f53cb43c6018184ce5d4e37"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.15.0"
            },
            {
              "fixed": "6.18.55"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.19.0"
            },
            {
              "fixed": "7.2.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98552.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/core: Fix a refcount leak in attach_perf_ctx_data()\n\nThe attach_perf_ctx_data() can race on global and !global cases.  The\nglobal case is protected by global_ctx_data_rwsem and shares a single\nreference count using perf_ctx_data.global field.\n\nBut when it races with !global case, it may miss to set the global field\nand result in a reference count leak.\n\n CPU1                                  CPU2\n ----------------------------------------------------------------\n attach_task_ctx_data(.global=1)       attach_task_ctx_data(.global=0)\n   cd1 = alloc_perf_ctx_data();          cd2 = alloc_perf_ctx_data();\n                                         //    { .global = 0, .refcount = 1 };\n\n                                         try_cmpxchg(); // success,\n                                         // task-\u003eperf_ctx_data = cd2\n   try_cmpxhg(); // fail; old = cd2\n   refcount_inc_not_zero(\u0026old-\u003erefcount); // success\n     // old.refcount = 2\n   free_perf_ctx_data(cd1);\n\nThen later detach_global_ctx_data() will see the data but it's not\nmarked as global, so it won't call detach_task_ctx_data().",
  "id": "CVE-2026-98552",
  "modified": "2026-10-20T02:31:02.871349099Z",
  "published": "2026-10-18T15:18:19.810Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/23250517cd475367653f1e99396967f54c6f1b7c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5286d4eb5cd7e10d7d93c3cc596e18bc8ad80f72"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/cca4980630b3c7a85f53cb43c6018184ce5d4e37"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98552.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98552"
    }
  ],
  "schema_version": "1.9.0",
  "summary": "perf/core: Fix a refcount leak in attach_perf_ctx_data()"
}