In the Linux kernel, the following vulnerability has been resolved: perf/core: Detach event groups during remove_on_exec perf_event_remove_on_exec() removes events by calling perf_event_exit_event(). For top-level events, this removes the event from the context with DETACH_EXIT only. This can leave inconsistent group state when a removed event is a group leader and the group contains siblings without remove_on_exec. If the group was active, the surviving siblings can remain active and attached to the removed leader's sibling list, but are no longer represented by a valid group leader on the PMU context active lists. A later close of the removed leader uses DETACH_GROUP and can promote the still-active siblings from this stale group state. The next schedule-in can then add an already-linked active_list entry again, corrupting the PMU context active list. With DEBUG_LIST enabled, this is caught as a list_add double-add in merge_sched_in(). Fix this by detaching group relationships
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-64556 is a vulnerability in the Linux kernel's performance monitoring subsystem that occurs when perf_event_remove_on_exec() improperly handles event group removal. When a group leader event is removed due to the remove_on_exec flag, sibling events without this flag can remain in an active but orphaned state, creating inconsistent kernel data structures. This affects system administrators and users running Linux systems where unprivileged performance event monitoring is enabled, potentially allowing local attackers to trigger kernel instability, information disclosure, or privilege escalation through manipulation of perf event groups.
While this CVE does not currently map to specific MITRE ATT&CK techniques, Casky.ai's platform would help security practitioners identify related attack patterns through extended reasoning across the 754 mapped security skills. A practitioner analyzing this vulnerability would look for detection patterns associated with kernel memory corruption (T1499 - Resource Exhaustion), local privilege escalation attempts (T1134 - Access Token Manipulation), and information disclosure through kernel state inspection (T1526 - System Information Discovery). Claude AI's extended reasoning capability would enable practitioners to correlate perf subsystem anomalies—such as unusual event group structures, orphaned active events, and kernel memory inconsistencies—with the attack surface this vulnerability creates, allowing them to develop behavioral detection rules and identify exploitation attempts before successful compromise occurs.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-64556. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation