CVE-2026-72237

A flaw was found in the Linux kernel. A local user can exploit a vulnerability in the perf subsystem on AMD processors utilizing the Branch Sampling (BRS) feature. This flaw occurs because the software filtering mechanism for branch records only validates the branch-to address, leaving the branch-from address unchecked. This oversight allows kernel addresses to be exposed to user space, leading to information disclosure.

A moderate-impact information disclosure flaw was found in the Linux kernel perf subsystem on AMD processors that support the Branch Sampling (BRS) feature (Zen 3). BRS provides no hardware branch filtering, so privilege-level filtering is performed entirely in software; however, the amd_brs_match_plm() filter only validated the branch-to address against the requested privilege levels. As a result, a local user requesting a user-only branch stack (PERF_SAMPLE_BRANCH_USER) could still receive branch records that originate in the kernel, such as SYSRET or interrupt returns, exposing kernel addresses to user space. This disclosure can weaken KASLR and aid exploitation of other local kernel vulnerabilities, but does not by itself cause memory corruption or privilege escalation. The vulnerable code is present in Red Hat Enterprise Linux 8 (from 8.8 onward), Red Hat Enterprise Linux 9 (from 9.2 onward), Red Hat Enterprise Linux 10, and Red Hat In-Vehicle OS kernel streams; Red Hat Enterprise Linux 6, 7, 8.4, and 8.6 are not affected because the vulnerable code is not present in those streams. For the affected streams the fix is currently deferred: triggering the flaw requires local access and the ability to use perf branch sampling, and the outcome is limited to kernel address disclosure, so remediation is deferred to a future update and the residual risk is exposure of kernel addresses that could assist a KASLR bypass on affected AMD Zen 3 systems.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

The flaw can only be triggered through perf branch sampling on AMD processors that support BRS (Zen 3). Unprivileged access to perf events can be restricted by raising the kernel.perf_event_paranoid sysctl to a restrictive value (for example 'sysctl -w kernel.perf_event_paranoid=3', persisted under /etc/sysctl.d/), or by ensuring unprivileged users do not hold perf-related capabilities such as CAP_PERFMON. These measures prevent unprivileged local users from requesting the branch samples through which kernel addresses are leaked.