CVE-2026-97587 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, RISC-V system administrators, and security teams responsible for Linux kernel patching and vulnerability management. These stakeholders should review the Linux kernel patch notes and Git commit history for implementation guidance, assess exposure for systems using RISC-V and perf subsystem, and verify the version and configuration of the Linux kernel.

Why it matters

A vulnerability in the Linux kernel's perf subsystem for RISC-V could lead to potential out-of-bounds reads on 32-bit systems. Defenders should review Linux kernel patch notes and Git commit history for implementation guidance, assess exposure for systems using RISC-V and perf subsystem, and verify version and configuration of Linux kernel.

• Verify Linux kernel version and configuration for RISC-V systems
• Assess exposure and prioritize patching for affected systems

Technical summary

The Linux kernel's perf subsystem for RISC-V used an incorrect definition for the available-counter mask, potentially causing out-of-bounds reads on 32-bit systems. The issue was resolved by using DECLARE_BITMAP and set_bit/bitmap helpers. This fix prevents out-of-bounds reads by properly defining and managing the available-counter mask as a bitmap. The change involves updating the counter mask definition and utilizing bitmap helpers for its management. This ensures that the counter mask is handled correctly, preventing out-of-bounds reads on 32-bit systems.

Defensive priority

Medium

Recommended defensive actions

• Review Linux kernel patch notes and Git commit history for implementation guidance
• Assess exposure for systems using RISC-V and perf subsystem
• Verify version and configuration of Linux kernel
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. The Linux kernel patch notes and Git commit history are available for further analysis. The patch involves changing the available-counter mask definition and using bitmap helpers. This change is aimed at preventing out-of-bounds reads on 32-bit systems by properly handling the counter mask.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.