CVE-2026-72237
Received Received - Intake

BaseFortify

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd/brs: Fix kernel address leakage A user-only branch stack can contain branches that originate from the kernel. As a result, kernel addresses are exposed to user space even when PERF_SAMPLE_BRANCH_USER is requested. On AMD processors supporting X86_FEATURE_BRS (Zen 3 only), perf can still report entries such as SYSRET/interrupt returns for which the branch-from addresses are in the kernel. E.g. $ perf record -j any,u -c 4000 -e branch-brs -o - -- \ perf bench syscall basic --loop 1000 | \ perf script -i - -F brstack|tr ' ' '\n'| \ grep -E '0x[89a-f][0-9a-f]{15}' ... 0xffffffff810001c4/0x72e2e32955eb/-/-/-/0//- 0xffffffff810001c4/0x72e2d94a9821/-/-/-/0//- 0xffffffff810001c4/0x72e2d94ffa1b/-/-/-/0//- ... BRS provides no hardware branch filtering, so privilege level filtering is performed entirely in software. However, amd_brs_match_plm() only validates the branch-to address against the requested privilege levels. For branches from the kernel to user space, the branch-from address is left unchecked and is leaked. Extend the software filter to also validate the branch-from address, so that any branch record whose branch-from address is in the kernel is dropped when PERF_SAMPLE_BRANCH_USER is requested.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-72237
EUVD
EUVD-2026-59136

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel allows kernel memory addresses to leak to user space through branch stack records on AMD Zen 3 processors. The issue occurs because the Branch Record Store (BRS) feature does not properly filter kernel addresses when PERF_SAMPLE_BRANCH_USER is used, exposing sensitive kernel memory locations.

Detection Guidance

To detect this vulnerability, you can use the perf command on AMD Zen 3 processors with BRS support. Run the provided command to check for kernel address leakage in branch stack samples. If kernel addresses appear in output, the system may be vulnerable.

Impact Analysis

An attacker could exploit this to learn kernel memory addresses, which may help in bypassing security protections like ASLR or crafting more effective exploits. This could lead to privilege escalation or other malicious activities if combined with other vulnerabilities.

Mitigation Strategies

Apply the Linux kernel patch that fixes the issue. Disable BRS (Branch Record Storage) if not required, or ensure your kernel version includes the fix for amd_brs_match_plm() validation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72237. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart