Linux kernel perf/x86: out-of-bounds read when an auto-counter-reload group mixes in software events

Impact

The Intel PMU code assumed every event in an auto counter reload (ACR) group belonged to the x86 hybrid PMU. When a software event was in the group, a container_of conversion in intel_pmu_set_acr_caused_constr could read kernel memory out of bounds. The record does not describe a working exploit. NVD scores it 7.8, but the documented effect is an out-of-bounds read in perf event setup. Only Intel x86 hosts with ACR-capable PMUs running a kernel that has the ACR code are exposed. The listed affected versions start at 6.16.

Who can reach it

A local user who can call perf_event_open on the host kernel. Low privileges are needed. Whether an unprivileged user or container can reach it depends on kernel.perf_event_paranoid and the container seccomp profile, and the default container runtime profiles usually block perf_event_open. No network path.

What to do

Install a kernel build that has the stable fix (commits referenced below), then drain and reboot each node to load it. Until then, raising kernel.perf_event_paranoid or keeping perf_event_open blocked in tenant seccomp profiles limits who can reach the code. The record does not name fixed distribution kernel versions.

References

Related entries

• Linux kernel xen/privcmd: partial munmap of a privcmd mapping leads to a double free (XSA-487)CVE-2026-31787 · Linux kernel Xen privcmd driver (VMA splitting on hypercall mappings)High
• uutils coreutils: chroot --userspec resolves the user inside the new root, loading attacker NSS modules as rootCVE-2026-35368 · uutils coreutils `chroot --userspec` (NSS module load after chroot)High
• sudo: failed setuid/setgid/setgroups before running the mailer is non-fatal, allowing privilege escalationCVE-2026-35535 · sudo (privilege drop before invoking the mailer)High
• QEMU: guest-triggered out-of-bounds write when a physical memory map returns shortCVE-2026-3842 · QEMU (cpu_physical_memory_map short-mapping handling)High
• Linux kernel BPF verifier: atomic-fetch precision gap lets equivalent-looking states be prunedCVE-2026-43009 · Linux kernel BPF verifier (precision backtracking for atomic fetch instructions)High
• Linux kernel sockmap: use-after-free of sk->sk_socket when an AF_UNIX peer is orphanedCVE-2026-43016 · Linux kernel BPF sockmap (sk_psock_verdict_data_ready)High