CVE-2026-31528

About vulnerability

In the Linux kernel, the following vulnerability has been resolved: perf: Make sure to use pmu_ctx->pmu for groups Oliver reported that x86_pmu_del() ended up doing an out-of-bound memory access when group_sched_in() fails and needs to roll back. This should be handled by the transaction callbacks, but he found that when the group leader is a software event, the transaction handlers of the wrong PMU are used. Despite the move_group case in perf_event_open() and group_sched_in() using pmu_ctx->pmu. Turns out, inherit uses event->pmu to clone the events, effectively undoing the move_group case for all inherited contexts. Fix this by also making inherit use pmu_ctx->pmu, ensuring all inherited counters end up in the same pmu context. Similarly, __perf_event_read() should use equally use pmu_ctx->pmu for the group case. A flaw was found in the Linux kernel’s performance monitoring unit (PMU) subsystem. This vulnerability occurs when handling performance event groups, specifically during the rollback of group_sched_in() operations. An issue with how inherited contexts use event pointers can lead to an out-of-bounds memory access. This could allow a local attacker to cause a denial of service or potentially escalate privileges.

Live-patch status from KernelCare for each operating system.