CVE-2026-72325 Linux CVE debrief

Who should care

Linux kernel users and administrators, as well as operators, platforms, vulnerability-management teams, and security teams, should be aware of this vulnerability and take steps to update their systems with the latest kernel patches to mitigate potential risks. This includes reviewing system configurations to ensure SVM and perf events are properly managed and monitoring system logs for any errors related to the Linux kernel's perf/x86/amd/core feature. Additionally, ensuring systems are updated with the latest kernel patches is crucial to mitigate potential risks associated with this vulnerability. Users of Linux kernel versions that may be affected by this vulnerability should prioritize patching and review their current configurations for potential exposure. Furthermore, maintaining up-to-date configurations and monitoring for unusual activity can help mitigate potential impacts of this and similar vulnerabilities. This vulnerability affects Linux kernel users, and it is essential to ensure systems are updated with the latest kernel patches to mitigate potential risks. Users should also review compensating controls for exposed systems while remediation is scheduled and verified. Tracking exceptions, retesting remediated assets, and closing the item only after evidence is documented are also crucial steps. The Linux community and users of Linux-based systems should be aware of the potential impacts of this vulnerability and take proactive steps to ensure their systems are secure. This includes staying informed about the latest patches and updates, reviewing system configurations, and implementing appropriate security measures. By taking these steps, users can help mitigate the risks associated with this vulnerability and ensure the security and integrity of their systems. Linux kernel users and administrators should prioritize patching and review their current configurations for potential exposure to this vulnerability. They should also consider implementing compensating controls for exposed systems while remediation is scheduled and verified. Furthermore, maintaining up-to-date configurations and monitoring for unusual activity can help mitigate potential of

Technical summary

The CVE-2026-72325 vulnerability is related to the Linux kernel's handling of perf/x86/amd/core features, specifically the interaction between Branch Sampling (BRS) and Last Branch Record (LBR). The kernel's reprogramming of host perf events when SVM is toggled can lead to enabling BRS inappropriately, causing a #GP error on certain processors. The fix ensures that BRS is not enabled from the event selector reprogramming path, even when LBR events are active.

Defensive priority

This vulnerability affects Linux kernel users. Ensure systems are updated with the latest kernel patches to mitigate potential risks.

Recommended defensive actions

• Update Linux kernel to the latest version to apply the fix for CVE-2026-72325.
• Review system configurations to ensure SVM and perf events are properly managed.
• Monitor system logs for any errors related to the Linux kernel's perf/x86/amd/core feature.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE-2026-72325 vulnerability involves a problem with the Linux kernel's perf/x86/amd/core feature, specifically with Branch Sampling (BRS) and Last Branch Record (LBR). These features are mutually exclusive, and enabling BRS from the SVM reload path can cause issues on certain processors, leading to a #GP error. The fix ensures BRS is not enabled in such cases.

Official resources