CVE-2026-31528
Out-of-Bounds Memory Access in Linux Kernel perf PMU Handling
Publication date: 2026-04-22
Last updated on: 2026-04-28
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | From 6.13 (inc) to 6.18.21 (exc) |
| linux | linux_kernel | From 6.19 (inc) to 6.19.11 (exc) |
| linux | linux_kernel | From 6.2 (inc) to 6.6.131 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.80 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's perf subsystem, specifically related to how performance monitoring units (PMUs) are handled for event groups. The issue occurs because the function x86_pmu_del() can perform an out-of-bound memory access when group_sched_in() fails and needs to roll back. This happens because the transaction callbacks use the wrong PMU context when the group leader is a software event. The root cause is that the inherit function uses event->pmu to clone events, which bypasses the intended move_group logic that should ensure all inherited counters remain in the same PMU context. The fix involves making inherit and __perf_event_read() use pmu_ctx->pmu to maintain consistent PMU contexts for all inherited counters and group cases.
How can this vulnerability impact me? :
This vulnerability can lead to out-of-bound memory access in the Linux kernel's perf subsystem, which may cause system instability, crashes, or potential security risks such as memory corruption. Since it involves incorrect handling of PMU contexts, it could affect the reliability and correctness of performance monitoring and profiling tools that rely on these kernel features.