Linux kernel AMD LBR: user-only branch sampling leaks kernel addresses to unprivileged users

Impact

On AMD processors with LBR v2 the hardware branch filter only checks the privilege level of the branch target, so a branch stack requested with PERF_SAMPLE_BRANCH_USER still returns SYSRET/ERET records whose branch-from address is in kernel text. An unprivileged local user who can run perf branch sampling reads back raw kernel text addresses, which defeats KASLR and gives a reliable base for a follow-on privilege escalation exploit. On a GPU node this matters where tenants get real shell access on the host or in a privileged container: EPYC hosts are the standard head for MI300 and H100/H200 nodes, and KASLR is often the only thing standing between a local bug and root on a box shared by several jobs. This is an information disclosure only - it does not by itself give code execution.

Who can reach it

Local unprivileged user on an AMD host with X86_FEATURE_AMD_LBR_V2, able to open perf events with branch-stack sampling (kernel.perf_event_paranoid permissive enough, and perf_event_open reachable from the container's seccomp profile). No special privilege beyond that.

What to do

Take the stable kernel fix and reboot each affected AMD node; this is a kernel text change with no runtime knob, so it costs a drain and reboot per host. Until the reboot window, raise kernel.perf_event_paranoid (2 or 3) and block perf_event_open in container seccomp profiles so tenants cannot request branch stacks at all. The record lists stable commits only and names no distro-fixed version - check your vendor's kernel errata for the exact build.

References

Related entries

• Linux kernel iommufd: dma_buf_unpin() without dma_resv lock warns on every DMABUF IOAS teardownCVE-2026-80633 · Linux kernel iommufd (DMABUF-backed iopt_pages release path)Unscored
• Linux kernel CXL fwctl: supported-features query trips a fortify panic and takes the host downCVE-2026-80640 · Linux kernel cxl_core (fwctl get-supported-features path)Unscored
• Linux ccp/SEV: zero-length cert chain in PDH export hits a BUG_ON on CONFIG_DEBUG_VIRTUAL kernelsCVE-2026-80652 · Linux kernel crypto/ccp AMD PSP driver (SEV PDH export ioctl)Unscored
• Linux BPF LSM: attaching to xfrm_decode_session turns packet classification into a kernel panicCVE-2026-80669 · Linux kernel BPF LSM (xfrm_decode_session hook attachment)Unscored
• Linux kernel migrate_device: pte_pfn/pte_dirty called on non-present PTEs during device migrationCVE-2026-80686 · Linux kernel mm/migrate_device (migrate_vma_collect_pmd non-present PTE handling)Unscored
• Linux iommufd: vDEVICE alloc error path leaks the igroup mutex and deadlocks later vDEVICE operationsCVE-2026-80687 · Linux kernel iommufd/viommu (vDEVICE alloc ioctl igroup lock)Unscored