CVE-2026-97960

A flaw was found in the Linux kernel. A concurrency issue in the Intel Performance Monitoring Unit (PMU) subsystem allows the Precise Event-Based Sampling (PEBS) buffer draining routine to be re-entered unexpectedly. A local user could exploit this flaw while configuring performance events to trigger out-of-bounds memory access, potentially resulting in a denial of service (system crash).

A moderate concurrency flaw was found in the Linux kernel's Intel Performance Monitoring Unit (PMU) implementation. The Precise Event-Based Sampling (PEBS) buffer is shared by all events on a CPU, so the drain_pebs() routine must not be re-entered; however, drain_pebs() is also reachable from process context via intel_pmu_drain_pebs_buffer(), and because disabling a single counter does not stop other active counters from raising a performance monitoring interrupt, an in-flight drain can be interrupted and re-entered. A local user able to configure performance events could exploit this race so that the re-entered drain observes stale buffer state and performs an out-of-bounds memory access, most likely resulting in a denial of service (system crash). Affected products include Red Hat Enterprise Linux 9 (streams from 9.4 onward), Red Hat Enterprise Linux 10, Red Hat In-Vehicle OS 2, and OpenShift Container Platform releases shipping the RHEL 9 based CoreOS kernel, because the vulnerable code was introduced by a PEBS change first included in RHEL 9.4. Red Hat Enterprise Linux 6, 7, 8, and 9.2, and OpenShift Container Platform releases based on RHEL CoreOS 8, are not affected because the vulnerable code is not present. Red Hat rated the impact as Moderate (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because exploitation requires local access to the performance events subsystem and the demonstrated impact is denial of service rather than privilege escalation or data disclosure. A fix is currently deferred for the affected streams; the residual risk is that a local user with access to the perf subsystem could trigger a kernel crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.