CVE-2026-98937
kernel: kernel: information disclosure via unprivileged perf kernel callchain capture
Severity
LowRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · October 23, 2026
Updated · October 29, 2026
Description
A flaw was found in the Linux kernel's Performance Events (perf) subsystem. The kernel failed to enforce proper privilege checks when capturing kernel callchains (call stack traces). A local unprivileged user could exploit this vulnerability to bypass profiling restrictions and collect kernel call stack data, leading to information disclosure.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 3.3CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE-497 · Exposure of Sensitive System Information to an Unauthorized Control Sphere