Linux kernel perf: wrong PMU's transaction handlers on software-leader groups cause out-of-bounds access

Impact

When a perf event group's leader is a software event, inheritance cloned events using event->pmu instead of pmu_ctx->pmu, undoing the move_group placement and putting inherited counters in the wrong PMU context. Rolling back a failed group_sched_in() then runs the wrong PMU's transaction callbacks, and the reported symptom is an out-of-bounds memory access in x86_pmu_del(). __perf_event_read() had the same mismatch for the group case. This is host kernel memory corruption reachable through perf_event_open() with a mixed software/hardware group, and perf is not optional equipment on a GPU fleet - profilers, continuous-profiling agents and DCGM-adjacent tooling open these events routinely, so the path is exercised by normal operations as well as by an attacker.

Who can reach it

Local user able to call perf_event_open() and build an event group with a software leader - available unprivileged wherever perf_event_paranoid is relaxed, otherwise requiring CAP_PERFMON. Not remotely reachable.

What to do

Update the host kernel to a build carrying the stable fix commits below and reboot each node. Until then, restrict perf to privileged users (raise kernel.perf_event_paranoid, do not grant CAP_PERFMON to tenant pods), which closes the unprivileged path but still leaves your own profiling agents on the fixed code's behalf.

References

Related entries

• Linux kernel blk-cgroup: use-after-free on cgroup writeback release when the last blkcg reference dropsCVE-2026-31586 · Linux kernel blk-cgroup (cgwb_release_workfn / blkcg_unpin_online)High
• Linux kernel mm/filemap: nr_pages overflow in fault-around maps past the end of a large folioCVE-2026-31648 · Linux kernel mm/filemap (nr_pages overflow in filemap_map_pages)High
• Linux i915 GPU kernel driver: A use-after-free in the i915 GPU kernel driver. The general shape is that a GPU object isCVE-2026-31656 · Linux i915 GPU kernel driverHigh
• sudo: failed setuid/setgid/setgroups before running the mailer is non-fatal, allowing privilege escalationCVE-2026-35535 · sudo (privilege drop before invoking the mailer)High
• QEMU: guest-triggered out-of-bounds write when a physical memory map returns shortCVE-2026-3842 · QEMU (cpu_physical_memory_map short-mapping handling)High
• Linux kernel BPF verifier: atomic-fetch precision gap lets equivalent-looking states be prunedCVE-2026-43009 · Linux kernel BPF verifier (precision backtracking for atomic fetch instructions)High