{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.187-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.105-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.9-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux-6.12"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.107-1~deb12u1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  perf/core: Fix group leader use-after-free after sibling detach  perf_group_detach() handles leader and sibling detach differently. When the group leader is detached, all siblings are promoted to singleton events and their group_leader pointer is reset to themselves. When a sibling is detached, it is removed from the leader's sibling_list, but its group_leader pointer is left pointing at the old leader.  That is harmless when the sibling is being closed and freed immediately, as in the DETACH_DEAD path. It is not safe when the sibling is detached but kept alive, such as during CPU hotplug with DETACH_GROUP. In that case the sibling is removed from the context, while its file descriptor can still keep it alive.  A typical failing sequence is:    - A group contains leader L and sibling S.   - CPU hot-unplug detaches S with DETACH_GROUP, removing it from     L-\u003esibling_list but leaving S-\u003egroup_leader == L.   - L is later closed and freed.   - A PERF_IOC_FLAG_GROUP ioctl on S follows S-\u003egroup_leader and     dereferences the freed leader.  This was reproduced by running the perf event fuzzer, CPU hotplug, and a stress workload concurrently:    Unable to handle kernel paging request at virtual address 006b6b6b6b6b6cdb   CPU: 2 PID: 12489 Comm: perf_fuzzer 6.18.7 PREEMPT   pc : perf_ioctl+0x34c/0xc68   x20: ffffff89a3fa2c70 x8 : 6b6b6b6b6b6b6b6b   Code: 943c4a0e 340047a0 f9404a94 f9411e88 (f940b908)   Call trace:   perf_ioctl+0x34c/0xc68 (P)   __arm64_sys_ioctl+0xa0/0xf4   invoke_syscall+0x58/0xe4   el0_svc_common+0xa8/0xdc   do_el0_svc+0x1c/0x28   el0_svc+0x40/0xc0   el0t_64_sync_handler+0x68/0xdc   el0t_64_sync+0x1c4/0x1c8  The fault happened in perf_ioctl(), where perf_event_for_each() follows the stale group_leader pointer and perf_event_for_each_child() then dereferences the freed leader's context.  Fix the use-after-free by promoting the detached sibling to a singleton. Also fix __event_disable() cgroup accounting and event state change.",
  "id": "DEBIAN-CVE-2026-74637",
  "modified": "2026-09-19T21:47:28.685837961Z",
  "published": "2026-08-22T16:16:36.890Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-74637"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-74637"
  ]
}