CVE-2026-72325: perf/x86/amd/core: Avoid enabling BRS from the SVM reload path
In the Linux kernel, the following vulnerability has been resolved:
perf/x86/amd/core: Avoid enabling BRS from the SVM reload path
Branch Sampling (BRS) and Last Branch Record (LBR) are mutually exclusive hardware features, and users of both are tracked via cpuc->lbrusers.
When SVM is toggled on a CPU, the host perf events are reprogrammed to update the HostOnly filter bit (set when virtualization is enabled, cleared when it is disabled). On PerfMonV2-capable processors, this reprogramming is performed by calling amdpmuenableall() to rewrite the event selectors. However, amdpmuenableall() also calls amdbrsenableall(), which enables BRS whenever cpuc->lbrusers > 0. Having active LBR events satisfies this gating on processors that have LBR but not BRS. The kernel then tries to set the BRS enable bit in DebugExtnCfg (MSR 0xc000010f). Since that bit is deprecated on such hardware, the write results in a #GP:
Call Trace: <IRQ> amdpmuenableall+0x1d/0x90 amdpmudisablevirt+0x62/0xb0 kvmarchdisablevirtualizationcpu+0xa/0x40 [kvm] hardwaredisablenolock+0x1a/0x30 [kvm] flushsmpcallfunctionqueue+0x9b/0x410 sysveccallfunction+0x18/0xc0 sysveccallfunction+0x69/0x90 </IRQ> <TASK> asmsysveccallfunction+0x16/0x20 RIP: 0010:cpuidleenterstate+0xc4/0x450 ? cpuidleenterstate+0xb7/0x450 cpuidleenter+0x29/0x40 cpuidleidlecall+0xf5/0x160 doidle+0x7b/0xe0 cpustartupentry+0x26/0x30 startsecondary+0x115/0x140 secondarystartup64noverify+0x194/0x19b </TASK>
Fix this by ensuring that BRS is not enabled from the event selector reprogramming path even when cpuc->lbrusers > 0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch perf/x86/amd/core: Avoid enabling BRS from the SVM reload path - Configuration
Fix the vulnerability by ensuring that BRS is not enabled from the event selector; avoid enabling BRS from the SVM reload path (amd_pmu_enable_all / amd_brs_enable_all path) so BRS is not set when cpuc->lbr_users > 0.
Linux kernel (perf/x86/amd/core) BRS enable bit in perf event MSR (via event selector gating) = Ensure BRS is not enabled from the event selector when processing SVM reload path (i.e., prevent setting BRS enable when LBR is active)