CVE-2026-80602
Received Received - Intake

Kernel Address Leakage in Linux perf/x86/amd/lbr

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd/lbr: Fix kernel address leakage A user-only branch stack can contain branches that originate from the kernel. As a result, kernel addresses are exposed to user space even when PERF_SAMPLE_BRANCH_USER is requested. On AMD processors supporting X86_FEATURE_AMD_LBR_V2, perf can still report SYSRET/ERET entries for which the branch-from addresses are in the kernel. E.g. $ perf record -e cycles -o - -j any,save_type,u -- \ perf bench syscall basic --loop 1000 | \ perf script -i - -F brstack|tr ' ' '\n'| \ grep -E '0x[89a-f][0-9a-f]{15}' ... 0xffffffff81001268/0x717a90a38f1a/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH 0xffffffff81001268/0x717a90a39157/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH 0xffffffff81001268/0x717a90a2c628/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH 0xffffffff81001268/0x717a90a41b60/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH 0xffffffff81001268/0x717a90a260db/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH 0xffffffff81001268/0x717a90a260db/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH 0xffffffff81001268/0x717a8bef1c30/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH 0xffffffff81001268/0x717a8e4d3c90/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH ... The reason is that the hardware filter only considers the privilege level applicable to the branch target. Extend software filtering to also validate the branch-from addresses against br_sel, so that any branch record whose branch-from address is in the kernel is dropped when PERF_SAMPLE_BRANCH_USER is requested.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-28
Last Modified
2026-08-28
Generated
2026-09-17
AI Q&A
2026-08-28
EPSS Evaluated
2026-09-15
NVD
CVE-2026-80602
EUVD
EUVD-2026-67478

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel allows kernel memory addresses to leak to user space through branch stack records. It affects AMD processors with X86_FEATURE_AMD_LBR_V2. When using perf with PERF_SAMPLE_BRANCH_USER, kernel addresses may still appear in branch records due to incomplete hardware filtering.

Detection Guidance

The vulnerability can be detected by checking for kernel address leaks in branch stack records using perf commands. Run the provided example command to capture and analyze branch records for kernel addresses. If kernel addresses (e.g., 0xffffffff81001268) appear in user space output, the system may be vulnerable.

Impact Analysis

An attacker could exploit this to learn kernel memory layout, which aids in bypassing security mechanisms like ASLR. This could lead to privilege escalation or other attacks if combined with other vulnerabilities.

Compliance Impact

This vulnerability exposes kernel memory addresses to user space, which could potentially leak sensitive system information. For compliance with standards like GDPR or HIPAA, such information exposure may violate data protection requirements by revealing internal system details that could aid in further attacks or unauthorized access.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. Update your system to a kernel version containing the fix for perf/x86/amd/lbr kernel address leakage. Monitor vendor advisories for patches specific to AMD processors with X86_FEATURE_AMD_LBR_V2.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80602. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart