CVE-2026-90272

A flaw was found in the Linux kernel's perf: arm_pmuv3 component. The hw_id branch stack field, which is passed to userspace, was not properly initialized by the Branch Record Buffer Extension (BRBE) driver. This could lead to the disclosure of uninitialized memory to userspace, potentially allowing an attacker to gain sensitive information or cause unexpected behavior.

This vulnerability is rated as Moderate impact because exploitation requires local system access and is strictly limited to ARM systems supporting the Branch Record Buffer Extension (BRBE). In typical Red Hat Enterprise Linux deployments, the issue only leaks uninitialized stack memory without allowing direct privilege escalation or system disruption. Furthermore, earlier platforms such as RHEL 8 and 9 do not contain the affected driver implementation. The exposure is limited to environments where unprivileged users can initiate performance monitoring on compatible ARM64 hardware.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.