{"id":"CVE-2026-31528","state":"PUBLISHED","title":"perf: Make sure to use pmu_ctx->pmu for groups","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nperf: Make sure to use pmu_ctx->pmu for groups\n\nOliver reported that x86_pmu_del() ended up doing an out-of-bound memory access\nwhen group_sched_in() fails and needs to roll back.\n\nThis *should* be handled by the transaction callbacks, but he found that when\nthe group leader is a software event, the transaction handlers of the wrong PMU\nare used. Despite the move_group case in perf_event_open() and group_sched_in()\nusing pmu_ctx->pmu.\n\nTurns out, inherit uses event->pmu to clone the events, effectively undoing the\nmove_group case for all inherited contexts. Fix this by also making inherit use\npmu_ctx->pmu, ensuring all inherited counters end up in the same pmu context.\n\nSimilarly, __perf_event_read() should use equally use pmu_ctx->pmu for the\ngroup case.","publishedAt":"2026-04-22T13:54:41.180Z","updatedAt":"2026-10-19T18:45:55.081Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"bd27568117664b8b3e259721393df420ed51f57b","status":"affected","lessThan":"656f35b463995bee024d948440128230aacd81e1","versionType":"git"},{"version":"bd27568117664b8b3e259721393df420ed51f57b","status":"affected","lessThan":"3a696e84a8b1fafdd774bb30d62919faf844d9e4","versionType":"git"},{"version":"bd27568117664b8b3e259721393df420ed51f57b","status":"affected","lessThan":"35f7914e54fe7f13654c22ee045b05e4b6d8062b","versionType":"git"},{"version":"bd27568117664b8b3e259721393df420ed51f57b","status":"affected","lessThan":"4c759446046500a1a6785b25725725c3ff087ace","versionType":"git"},{"version":"bd27568117664b8b3e259721393df420ed51f57b","status":"affected","lessThan":"4b9ce671960627b2505b3f64742544ae9801df97","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/events/core.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.2","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.2","versionType":"semver"},{"version":"6.6.131","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.80","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.21","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19.11","status":"unaffected","lessThanOrEqual":"6.19.*","versionType":"semver"},{"version":"7.0","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/events/core.c"]}],"references":["https://git.kernel.org/stable/c/656f35b463995bee024d948440128230aacd81e1","https://git.kernel.org/stable/c/3a696e84a8b1fafdd774bb30d62919faf844d9e4","https://git.kernel.org/stable/c/35f7914e54fe7f13654c22ee045b05e4b6d8062b","https://git.kernel.org/stable/c/4c759446046500a1a6785b25725725c3ff087ace","https://git.kernel.org/stable/c/4b9ce671960627b2505b3f64742544ae9801df97"],"weaknesses":["CWE-787"],"ingestedAt":"2026-10-29T20:11:40.391Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/31xxx/CVE-2026-31528.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-31528","state":"PUBLISHED","datePublished":"2026-04-22T13:54:41.180Z","dateUpdated":"2026-10-19T18:45:55.081Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-03-09T15:48:24.111Z"},"containers":{"cna":{"title":"perf: Make sure to use pmu_ctx->pmu for groups","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nperf: Make sure to use pmu_ctx->pmu for groups\n\nOliver reported that x86_pmu_del() ended up doing an out-of-bound memory access\nwhen group_sched_in() fails and needs to roll back.\n\nThis *should* be handled by the transaction callbacks, but he found that when\nthe group leader is a software event, the transaction handlers of the wrong PMU\nare used. Despite the move_group case in perf_event_open() and group_sched_in()\nusing pmu_ctx->pmu.\n\nTurns out, inherit uses event->pmu to clone the events, effectively undoing the\nmove_group case for all inherited contexts. Fix this by also making inherit use\npmu_ctx->pmu, ensuring all inherited counters end up in the same pmu context.\n\nSimilarly, __perf_event_read() should use equally use pmu_ctx->pmu for the\ngroup case."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"bd27568117664b8b3e259721393df420ed51f57b","status":"affected","lessThan":"656f35b463995bee024d948440128230aacd81e1","versionType":"git"},{"version":"bd27568117664b8b3e259721393df420ed51f57b","status":"affected","lessThan":"3a696e84a8b1fafdd774bb30d62919faf844d9e4","versionType":"git"},{"version":"bd27568117664b8b3e259721393df420ed51f57b","status":"affected","lessThan":"35f7914e54fe7f13654c22ee045b05e4b6d8062b","versionType":"git"},{"version":"bd27568117664b8b3e259721393df420ed51f57b","status":"affected","lessThan":"4c759446046500a1a6785b25725725c3ff087ace","versionType":"git"},{"version":"bd27568117664b8b3e259721393df420ed51f57b","status":"affected","lessThan":"4b9ce671960627b2505b3f64742544ae9801df97","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/events/core.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.2","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.2","versionType":"semver"},{"version":"6.6.131","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.80","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.21","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19.11","status":"unaffected","lessThanOrEqual":"6.19.*","versionType":"semver"},{"version":"7.0","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/events/core.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/656f35b463995bee024d948440128230aacd81e1"},{"url":"https://git.kernel.org/stable/c/3a696e84a8b1fafdd774bb30d62919faf844d9e4"},{"url":"https://git.kernel.org/stable/c/35f7914e54fe7f13654c22ee045b05e4b6d8062b"},{"url":"https://git.kernel.org/stable/c/4c759446046500a1a6785b25725725c3ff087ace"},{"url":"https://git.kernel.org/stable/c/4b9ce671960627b2505b3f64742544ae9801df97"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable perf group/inheritance paths are reached through the local perf_event_open syscall and subsequent fork/scheduling/read operations, not by network or physical input.\nAC:L - An attacker controls the perf event group composition, inherit flag, fork, and can create an over-constrained hardware group to force group_sched_in rollback; no uncontrollable race is required.\nPR:L - A normal unprivileged local user can create per-process user-space perf events under the default perf_event_paranoid=2 policy by excluding kernel profiling, so real administrative privileges are not required.\nUI:N - The attacker can trigger the sequence entirely from their own process using perf_event_open and fork/read/scheduling activity without any victim action.\nS:U - The bug corrupts kernel perf/PMU bookkeeping within the same kernel security authority and does not cross a VM, IOMMU, or other separate security boundary.\nC:H - The reported out-of-bounds access occurs in kernel PMU bookkeeping and includes memory corruption in per-CPU structures; per the higher-severity rule, this can reasonably be leveraged for kernel information disclosure.\nI:H - The rollback path can drive x86_pmu_del with inconsistent PMU transaction state, causing out-of-bounds writes such as invalid PMU array/bitmap updates, which is kernel memory corruption with potential control-flow or privilege impact.\nA:H - Even without full exploitation, the out-of-bounds kernel access can reliably produce a kernel warning/oops/panic or corrupt PMU state, causing high availability impact."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T12:23:18.524Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.6.131"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.12.80"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.18.21"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.19.11"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"7.0"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-31528","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-16T15:10:38.614462Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-787","lang":"en","type":"CWE","description":"CWE-787 Out-of-bounds Write"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-19T18:45:55.081Z"}}]}}}