CVE-2026-97587
Received Received - Intake

Heap Buffer Overflow in Linux Kernel perf Subsystem

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: perf: RISC-V: store available counter mask as bitmap The available-counter mask was a single unsigned long, but iteration uses RISCV_MAX_COUNTERS, which is 64. On RV32 that reads past the object. Filling with an unsigned-long bit at index 32 and above is also wrong. Use DECLARE_BITMAP and set_bit/bitmap helpers. Walk each bitmap word into CFG_MATCH when checking events, when allocating an index, and when stopping all counters. Set the counter base to i times BITS_PER_LONG. Share the CFG_MATCH ecall through a small helper so the 32-bit argument split is not duplicated. On qemu-system-riscv32 the probe bitmap has bits above XLEN set, so the first word alone is not enough. [pjw@kernel.org: updated to apply; fixed checkpatch.pl issues]

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97587
EUVD
EUVD-2026-86895

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel to 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves incorrect handling of counter masks for RISC-V systems. The available-counter mask was stored as a single unsigned long, but iteration uses RISCV_MAX_COUNTERS (64). On RV32 systems, this causes reading past the object's bounds. The issue arises because filling the mask with an unsigned long at index 32 and above is incorrect. The fix involves using DECLARE_BITMAP and set_bit/bitmap helpers to properly manage the counter mask.

Detection Guidance

This vulnerability is specific to the Linux kernel's perf subsystem on RISC-V architecture. Detection requires checking kernel version and RISC-V support. Use uname -a to verify kernel version and grep for RISC-V in /proc/cpuinfo. No direct network detection commands are applicable.

Impact Analysis

This vulnerability could lead to memory corruption or undefined behavior on RISC-V systems running the Linux kernel. Specifically, it may cause crashes, data corruption, or security issues due to improper handling of counter masks. Systems using RV32 (32-bit RISC-V) are particularly affected, as the bug causes out-of-bounds memory access.

Mitigation Strategies

Update the Linux kernel to the patched version that resolves this issue. Monitor kernel security advisories for RISC-V specific updates. If using custom kernels, apply the patch that changes available-counter mask handling to use DECLARE_BITMAP and bitmap helpers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97587. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart