CVE-2026-98552: perf/core: Fix a refcount leak in attach_perf_ctx_data()

In the Linux kernel, the following vulnerability has been resolved:

perf/core: Fix a refcount leak in attachperfctxdata()

The attachperfctxdata() can race on global and !global cases. The global case is protected by globalctxdatarwsem and shares a single reference count using perfctxdata.global field.

But when it races with !global case, it may miss to set the global field and result in a reference count leak.

CPU1 CPU2 ---------------------------------------------------------------- attachtaskctxdata(.global=1) attachtaskctxdata(.global=0) cd1 = allocperfctxdata(); cd2 = allocperfctxdata(); // { .global = 0, .refcount = 1 };

trycmpxchg(); // success, // task->perfctxdata = cd2 trycmpxhg(); // fail; old = cd2 refcountincnotzero(&old->refcount); // success // old.refcount = 2 freeperfctxdata(cd1);

Then later detachglobalctxdata() will see the data but it's not marked as global, so it won't call detachtaskctxdata().