CVE-2026-80602: perf/x86/amd/lbr: Fix kernel address leakage
In the Linux kernel, the following vulnerability has been resolved:
perf/x86/amd/lbr: Fix kernel address leakage
A user-only branch stack can contain branches that originate from the kernel. As a result, kernel addresses are exposed to user space even when PERFSAMPLEBRANCHUSER is requested. On AMD processors supporting X86FEATUREAMDLBRV2, perf can still report SYSRET/ERET entries for which the branch-from addresses are in the kernel.
E.g.
$ perf record -e cycles -o - -j any,savetype,u -- \ perf bench syscall basic --loop 1000 | \ perf script -i - -F brstack|tr ' ' '\n'| \ grep -E '0x[89a-f][0-9a-f]{15}'
... 0xffffffff81001268/0x717a90a38f1a/M/-/-/0/ERET/NONSPECCORRECTPATH 0xffffffff81001268/0x717a90a39157/M/-/-/0/ERET/NONSPECCORRECTPATH 0xffffffff81001268/0x717a90a2c628/M/-/-/0/ERET/NONSPECCORRECTPATH 0xffffffff81001268/0x717a90a41b60/M/-/-/0/ERET/NONSPECCORRECTPATH 0xffffffff81001268/0x717a90a260db/M/-/-/0/ERET/NONSPECCORRECTPATH 0xffffffff81001268/0x717a90a260db/M/-/-/0/ERET/NONSPECCORRECTPATH 0xffffffff81001268/0x717a8bef1c30/M/-/-/0/ERET/NONSPECCORRECTPATH 0xffffffff81001268/0x717a8e4d3c90/M/-/-/0/ERET/NONSPECCORRECTPATH ...
The reason is that the hardware filter only considers the privilege level applicable to the branch target. Extend software filtering to also validate the branch-from addresses against brsel, so that any branch record whose branch-from address is in the kernel is dropped when PERFSAMPLEBRANCHUSER is requested.
Affected Software
Event History
Frequently Asked Questions
Which systems are affected by this issue?
The issue applies to Linux systems running on AMD processors that support X86_FEATURE_AMD_LBR_V2 and use perf branch-stack sampling.
Can requesting only user-space branch entries prevent the leak?
No. Even when PERF_SAMPLE_BRANCH_USER is requested, perf can report SYSRET or ERET entries whose branch-from address is in kernel space.
How can I check for exposure?
Capture a perf branch stack with user branch sampling and inspect the output for kernel-range addresses in SYSRET or ERET entries. The provided example uses perf record with -j any,save_type,u and then searches the branch-stack output for addresses beginning with 0xffffffff.