PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-31528 Linux CVE debrief

A Linux kernel vulnerability has been identified and resolved, concerning the use of pmu_ctx->pmu for groups in the perf subsystem. This issue could lead to an out-of-bound memory access when group_sched_in() fails and needs to roll back, particularly when the group leader is a software event. The vulnerability was reported by Oliver, who found that x86_pmu_del() ended up doing an out-of-bound memory access. The issue arises from the improper use of pmu_ctx->pmu for groups, which can lead to out-of-bound memory access during rollback operations.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-22
Original CVE updated
2026-10-19
Advisory published
2026-04-22
Advisory updated
2026-10-19

Who should care

Linux system administrators, security teams, and developers working with the Linux kernel should assess exposure and apply patches or updates as necessary. This vulnerability may impact systems using the perf subsystem, particularly those with specific group configurations.

Why it matters

This vulnerability in the Linux kernel's perf subsystem requires attention from Linux system administrators and security teams to assess exposure and apply necessary patches or updates. The issue involves improper use of pmu_ctx->pmu for groups, potentially leading to out-of-bound memory access.

  • Verify patch deployment to prevent potential memory access issues.
  • Monitor system stability and performance in the perf subsystem.
  • Assess system configurations for exposure based on version and group settings.
  • Review and update incident response plans to address potential exploitation.

Technical summary

The Linux kernel vulnerability involves improper use of pmu_ctx->pmu for groups in the perf subsystem, potentially leading to out-of-bound memory access during rollback operations. The issue arises when the group leader is a software event, and transaction handlers of the wrong PMU are used. This vulnerability requires attention from Linux system administrators and security teams to assess exposure and apply necessary patches or updates. The issue can be resolved by ensuring that all inherited counters end up in the same pmu context.

Defensive priority

Medium

Recommended defensive actions

  • Review Linux kernel versions and assess exposure based on the provided commit hashes and version ranges.
  • Apply patches or updates from the Linux kernel maintainers as available.
  • Monitor system logs for unusual activity related to the perf subsystem.
  • Verify system configurations and permissions to restrict access to sensitive components.
  • Perform a thorough review of system configurations for exposure based on version and group settings.
  • Verify patch deployment to prevent potential memory access issues.
  • Assess system stability and performance in the perf subsystem.

Evidence notes

The CVE record and associated source item provide details on the vulnerability, including its resolution in the Linux kernel. However, specific version details and comprehensive impact assessments are limited.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-31528 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-31528

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-31528 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-31528

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • perf: Make sure to use pmu_ctx->pmu for groups

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/31xxx/CVE-2026-31528.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/656f35b463995bee024d948440128230aacd81e1

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/3a696e84a8b1fafdd774bb30d62919faf844d9e4

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/35f7914e54fe7f13654c22ee045b05e4b6d8062b

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/4c759446046500a1a6785b25725725c3ff087ace

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/4b9ce671960627b2505b3f64742544ae9801df97

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.