CVE-2026-72236 Linux CVE debrief

Who should care

Linux kernel developers, administrators, and security teams should be aware of this vulnerability and take immediate action. Affected product deployments need to be identified, and owners assigned for follow-up. The patch should be applied, and system configurations reviewed for potential exposure. Monitoring and detection mechanisms should be in place to identify potential exploitation attempts. Vulnerability management and security teams should prioritize this issue and ensure that compensating controls are in place for exposed systems while remediation is scheduled and verified. This requires coordination with operators and platform teams to ensure a comprehensive response.

Technical summary

The Linux kernel's perf_cpum_cf subsystem is vulnerable due to a missing array_index_nospec() call in __hw_perf_event_init(). An ev variable, controlled by userspace via event->attr.config, is used as an array index after bounds checking but without speculation barriers. This omission could enable speculative execution, potentially leading to security issues. Linux kernel developers should apply the patch to add array_index_nospec() to __hw_perf_event_init() and review system configurations for potential exposure.

Defensive priority

Apply the patch to add array_index_nospec() to __hw_perf_event_init()

Recommended defensive actions

• Apply the patch to add array_index_nospec() to __hw_perf_event_init()
• Inventory Linux kernel installations for potential exposure
• Monitor for potential exploitation attempts
• Review system configurations for potential exposure
• Verify the presence of the patch
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further analysis is required to fully understand the impact and affected scope. The vulnerability is in the Linux kernel's perf_cpum_cf subsystem, where an ev variable is userspace controlled via event->attr.config and used as an array index after bounds checking, but without speculation barriers. The missing array_index_nospec() call could allow speculative execution. Defenders should verify the presence of the patch and review system configurations for potential exposure.

Official resources