From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793187666; b=t6VJPTxwSR5LeC1YInurQtll+rFCMaGd0fpcEnyH4/ShN2zPVggi3KvWQuMwkrXEqyQW 17MmBtFQ9Rk06WqR8GseWIMRJwq1pcm0ZwAAq5p6XTwJLWi5HBvMP/Pder39dhnA88ZcG N2riAwWMnefVLR2vS0o5+c8ytLjY5apDlWZR5EZHa7y+clTkMndtMCDtM0MLy1HM2CrxK iqVEYpJFUFMqMqXHIudMD5FV+3ENfQtb2CDUKZUUJRkBp/LcdW/vhSKTdNUVSZ3PS7vfX e+v/IVak8XumLFEk3wemYIZa37uA+heKzaDCjbWLwRC420gmDeYuUmVGwkDpPMEDECg== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793187666; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: Reply-To:MIME-Version:Lines:X-Developer-Signature:X-Developer-Key: Content-Transfer-Encoding; bh=e7zpkNBkVpKnncakklfgl8g+COU6duQy6SV8yJ2eml8=; b=5dcF9P+vJ0FPq0xPwUNPaEK988ViQtyv4PGt2214Ccoke8F3AVuPEU8RSO8tZ+oMjpTh b+VaZz3hHmv3x2di9KEEQp1eLYp9aoiEAl5iJTi31d8SAJ6Ia9+7So6zHH6gWI9haNSt4 8OKPOmrvxjO/fZ/GtNgFPaNcN4tbSm99LpS1FKOiMPwKKE5K+IeBNhwp0CQcpiss+4PzU df73K/oI91JWvQdCYZMOucqlR4gXC+cpz802IHxDvNx96VNgnNoYZD7a4Wqpcgy/Fp6Ji JnQVI9lYP5hqZOV3LDFVaZ+rYbqd2Z1owYtTniKoy5lQNuSJ/REucXiVxfUajlQRDHQ== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b="nweQk78/"; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 832C4606A32C for ; Wed, 28 Oct 2026 11:41:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=nweQk78/ Received: by smtp.kernel.org (Postfix) with ESMTPSA id C386F1F01825; Wed, 28 Oct 2026 11:41:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1793187666; bh=e7zpkNBkVpKnncakklfgl8g+COU6duQy6SV8yJ2eml8=; h=From:To:Cc:Subject:Date:Reply-To; b=nweQk78/0CHgH4Nn32Yby5QSQlsV2DrSX5ZANX68tbvxZuoDzqlARvo8Zpq+DPMKk VKdUd0QR7J1KGq9yw6YBEyxIbfk31N9jeclW/He5UQ4ALjx5lFoUSOe0A6CxJcb7PL +0TBUlKiFtmz3DiaWS+9EjKfdMsa1V9zllyUIPx4= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-99187: perf: Fix perf_pmu_migrate_context() leaving events behind Date: Wed, 28 Oct 2026 11:36:14 +0100 Message-ID: <2026102811-CVE-2026-99187-e0c2@gregkh> X-Mailer: git-send-email 2.56.0 Reply-To: , X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2598; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=3ft4UkWCSV53LquZj+KBYaHtXFyljzHuCEo04N/jFjs=; b=owGbwMvMwCRo6H6F97bub03G02pJDFkPz99ff+97Tt6pKQZiiWum8EgJ/D11+rjL9X2H7DaGF PTNrw8u64hlYRBkYpAVU2T5so3n6P6KQ4pehranYeawMoEMYeDiFICJtCxnmB+aH39iZiMzS7fx opA6AasL9r5bzzIs2NruJLG5OeDw72mBT1f1H6x//SxGBwA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: perf: Fix perf_pmu_migrate_context() leaving events behind __perf_pmu_remove() walks the group leaders of a CPU and PMU with perf_event_groups_for_cpu_pmu(), removing each one as it goes. perf_remove_from_context() takes the leader out of the groups rbtree, after which rb_next() on that node returns NULL, prematurely ending the walk. Other groups stay behind in the source context. On CPU hotplug, they are then torn down with the dying CPU. They keep running until teardown, while the PMU's interrupt and migrated events are on a new CPU, which drivers rely on never happening. Walk ctx->event_list instead and pick out the PMU's events by their pmu_ctx. The Linux kernel CVE team has assigned CVE-2026-99187 to this issue. Affected and fixed versions =========================== Issue introduced in 6.2 with commit bd27568117664b8b3e259721393df420ed51f57b and fixed in 6.18.59 with commit 3eb08f09bfb364051f51316da873c3bd51a839ef Issue introduced in 6.2 with commit bd27568117664b8b3e259721393df420ed51f57b and fixed in 7.2.13 with commit f5f0028764de322a3d04eda0d3b6389ca9847446 Issue introduced in 6.2 with commit bd27568117664b8b3e259721393df420ed51f57b and fixed in 7.3 with commit e76b36b4be7160eaa14b416681e548b125702395 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-99187 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: kernel/events/core.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/3eb08f09bfb364051f51316da873c3bd51a839ef https://git.kernel.org/stable/c/f5f0028764de322a3d04eda0d3b6389ca9847446 https://git.kernel.org/stable/c/e76b36b4be7160eaa14b416681e548b125702395