CVE-2026-72236: s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init()
In the Linux kernel, the following vulnerability has been resolved:
s390/perfcpumcf: Add missing arrayindexnospec() to hwperfeventinit()
ev variable is userspace controlled via event->attr.config and used as an array index after bounds checking, but without speculation barriers.
Add the missing arrayindexnospec() call to prevent speculative execution.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72236?
CVE-2026-72236 has a risk rating of 15, indicating it is considered a high-severity vulnerability.
How do I fix CVE-2026-72236?
To fix CVE-2026-72236, ensure you install the latest Linux kernel patch that incorporates the missing array_index_nospec() protection.
What systems are affected by CVE-2026-72236?
CVE-2026-72236 affects Linux systems utilizing the s390 architecture and the perf_cpum_cf component.
What type of vulnerability is CVE-2026-72236?
CVE-2026-72236 is a denial of service vulnerability related to improper bounds checking that lacks speculation barriers.
When was CVE-2026-72236 published?
CVE-2026-72236 was published on August 15, 2026.