CVE-2026-97587

A flaw was found in the Linux kernel's RISC-V performance monitoring (perf) subsystem. On 32-bit RISC-V systems, the available counter mask was stored in a 32-bit data structure while the subsystem iterated over up to 64 counters, resulting in an out-of-bounds memory read. A local user could exploit this vulnerability during counter operations, potentially causing a Denial of Service (DoS) through a kernel crash or exposing sensitive kernel memory.

A moderate severity vulnerability was found in the Linux kernel's RISC-V performance monitoring (perf) subsystem. On 32-bit RISC-V (RV32) systems, the available counter mask was stored as a single unsigned long while the code iterates over up to RISCV_MAX_COUNTERS (64) counters, causing an out-of-bounds read past the object. A local user with access to the perf subsystem could trigger this flaw during counter operations, most likely resulting in a kernel crash and denial of service. Red Hat rates this flaw Moderate (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2 are affected; the fix is currently deferred for these products, and the residual risk while the fix is deferred is limited because the flaw is specific to 32-bit RISC-V systems and requires a local user able to exercise the affected perf counter code paths. Red Hat Enterprise Linux 6, 7, 8, and 9 (including the kernel-rt variants) and OpenShift Container Platform (RHEL CoreOS) are not affected because the vulnerable code is not present in those offerings.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.