CVE-2026-98937 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution vendors, and users of Linux-based systems who require kernel profiling and callchain collection, as well as operators, platform administrators, vulnerability management teams, and security teams responsible for maintaining and securing Linux-based systems.

Why it matters

The Linux kernel's perf/core component has a vulnerability that allows unprivileged users to request kernel callchain collection, potentially leading to unauthorized access to kernel data. Defenders should review and apply available patches, restrict access to kernel profiling, and monitor system logs for suspicious activity.

• Unprivileged users may be able to access kernel data through callchain collection.
• Kernel profiling and callchain collection may be used to gather sensitive information.
• The vulnerability requires kernel profiling privilege, but the existing check does not enforce it.
• Verification of kernel access and callchain collection is necessary to prevent unauthorized access.

Technical summary

The Linux kernel's perf/core component has a vulnerability that allows unprivileged users to request kernel callchain collection even when kernel sampling is excluded. This is due to an incomplete permission check that does not account for cases where attr.exclude_callchain_kernel is set to 0. The fix updates the permission check to call perf_allow_kernel() when either kernel sampling is requested or kernel callchains are requested.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the available patches to update the Linux kernel to a version that includes the fix.
• Restrict access to kernel profiling and callchain collection to privileged users.
• Monitor system logs for suspicious activity related to perf/core.
• Verify kernel access and callchain collection to prevent unauthorized access.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details about the vulnerability in the Linux kernel's perf/core component. The issue is related to the handling of kernel callchains and sampling. The vendor, Linux, has provided information about the affected versions and the fixes available.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.