The defect occurs in the Linux kernel perf subsystem when an exec call marks a perf event as EXIT and the system accepts that event as a group leader in subsequent perf_event_open calls. Because the event’s file descriptor can stay open, a new sibling may be linked to the detached leader. When the original leader is closed, the code path skips properly detaching the new sibling, leaving it with a pointer to freed memory. This results in a use‑after‑free condition inside the kernel, which can lead to memory corruption, crashes, or loss of integrity. The weakness is identified as CWE-825, the class of use‑after‑free bugs.

All Linux kernel releases that have not yet integrated the fix for CVE‑2026‑74753. The flaw is present in the generic Linux kernel; no specific version ranges are provided.

The CVSS score of 7.8 indicates a high severity. The EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, implying a relatively low likelihood of exploitation at present. The exploit would require the ability to create or manipulate perf events, which is typically restricted to privileged or specially‑configured processes, suggesting a local or elevated‑privilege attack vector. Successful exploitation could destabilize the kernel or corrupt memory, but the concrete impact depends on the ability to trigger the use‑after‑free path.