CVE-2026-72237 Linux CVE debrief

Who should care

Linux kernel users, administrators, and developers using AMD processors with X86_FEATURE_BRS support. Affected operators should review compensating controls for exposed systems while remediation is scheduled and verified. Vulnerability management and security teams should track exceptions, retest remediated assets, and close the item only after evidence is documented. Platform operators should check relevant monitoring, detection, and logs for exposed assets that need extra review. Security teams should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Asset inventory management should confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. System administrators should restrict access to perf features for sensitive data and monitor system calls and branch prediction for anomalies. Security teams should apply kernel updates to address the vulnerability and review the CVE record and NVD entry for details on the Linux kernel vulnerability. Multiple source references from kernel.org are available for further verification. The vulnerability allows kernel address leakage through the perf/x86/amd/brs feature, which can be exploited by attackers to gain unauthorized access to sensitive information. Therefore, it is essential for Linux kernel users, administrators, and developers to take immediate action to address this vulnerability and prevent potential attacks. This includes applying kernel updates, restricting access to perf features, and monitoring system calls and branch prediction for anomalies. Additionally, security teams should review compensating controls for exposed systems and track exceptions to ensure that the vulnerability is properly mitigated. By taking these steps, Linux kernel users can help prevent potential attacks and protect their systems from exploitation. The CVE record and NVD entry provide details on the Linux kernel vulnerability, and multiple source references from kernel.org are available for further verification. The vulnerability allows kernel address leakage through the perf/x86/amd/brs feature, which can be exploited by attackers.

Technical summary

The Linux kernel vulnerability CVE-2026-72237 allows kernel address leakage through the perf/x86/amd/brs feature. A user-only branch stack can contain branches originating from the kernel, exposing kernel addresses to user space. This occurs on AMD processors supporting X86_FEATURE_BRS (Zen 3 only) when perf reports entries like SYSRET/interrupt returns with branch-from addresses in the kernel. The software filter amd_brs_match_plm() only validates the branch-to address against the requested privilege levels, leaving the branch-from address unchecked and potentially leaked.

Defensive priority

Apply kernel updates to address the vulnerability. Restrict access to perf features for sensitive data.

Recommended defensive actions

• Apply kernel updates to address the vulnerability
• Restrict access to perf features for sensitive data
• Monitor system calls and branch prediction for anomalies
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the Linux kernel vulnerability. Multiple source references from kernel.org are available. The vulnerability allows kernel address leakage through the perf/x86/amd/brs feature. A user-only branch stack can contain branches originating from the kernel, exposing kernel addresses to user space. This occurs on AMD processors supporting X86_FEATURE_BRS (Zen 3 only) when perf reports entries like SYSRET/interrupt returns with branch-from addresses in the kernel. The software filter amd_brs_match_plm() only validates the branch-to address against the requested privilege levels, leaving the branch-from address unchecked and potentially leaked. To verify, defenders should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.