CVE-2026-31528

A flaw was found in the Linux kernel's performance monitoring unit (PMU) subsystem. This vulnerability occurs when handling performance event groups, specifically during the rollback of group_sched_in() operations. An issue with how inherited contexts use event pointers can lead to an out-of-bounds memory access. This could allow a local attacker to cause a denial of service or potentially escalate privileges.

Upstream ensures inherited and grouped perf events consistently use pmu_ctx->pmu, preventing rollback paths from touching the wrong PMU's transaction state when the group leader is software-defined. Red Hat recommends patched kernels for perf-heavy workloads. Unloading kvm_intel/kvm_amd is unrelated; perf is core.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.