CVE-2026-72236

A flaw was found in the Linux kernel's s390 performance monitoring component (s390/perf_cpum_cf). A userspace-controlled variable was used as an array index without proper speculation barriers. This could allow a local attacker to potentially exploit speculative execution, leading to information disclosure.

A moderate-impact flaw was found in the Linux kernel's s390 performance monitoring driver perf_cpum_cf, affecting the Red Hat Enterprise Linux kernel and kernel-rt components. In __hw_perf_event_init(), the 'ev' variable is controlled by userspace via event->attr.config and is used as an array index after bounds checking, but without the array_index_nospec() speculation barrier. A local attacker able to create the affected perf events on an s390 system could exploit this Spectre-v1-style speculative bounds-check bypass to cause a speculative out-of-bounds read, potentially disclosing sensitive kernel information through a microarchitectural side channel. The kernel and kernel-rt components in Red Hat Enterprise Linux 7, 8, 9, and 10 and the kernel components in Red Hat In-Vehicle OS are affected, with fixes currently deferred to a future update; the residual risk is that an unprivileged local user with access to the perf interface on the s390 architecture could attempt to exploit this information disclosure until a deferred update is released. Red Hat Enterprise Linux 6 Extended Lifecycle Support is out of support scope for this flaw. Exploitation requires local code execution and access to the perf subsystem, which limits exposure compared to remotely exploitable flaws.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.