CVE-2026-90272: perf: arm_pmuv3: Zero initialize hw_id branch stack field
In the Linux kernel, the following vulnerability has been resolved:
perf: armpmuv3: Zero initialize hwid branch stack field
PERFSAMPLEBRANCHHWINDEX is supported by BRBE so hwid is passed to userspace, but it's never set by the BRBE driver. Zero initialize it as it should be according to the docs:
For the architectures whose raw branch records are already stored in age order, the hwidx should be 0.
It's probably too risky to remove PERFSAMPLEBRANCHHWINDEX from BRBE now in case anyone is setting it and reading the value, but zero initializing the whole struct also protects against the same issue with new fields that are added in the future.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch perf: arm_pmuv3: Zero initialize hw_id branch stack field
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the Linux kernel on Arm with BRBE support are exposed when perf branch sampling uses PERF_SAMPLE_BRANCH_HW_INDEX. The affected path passes the hw_id field to userspace.
What would an attacker or local user need to do to trigger it?
They would need to collect perf branch records through the BRBE path with PERF_SAMPLE_BRANCH_HW_INDEX enabled. The issue occurs because the BRBE driver did not set the hw_id field before it was returned to userspace.
Is the reported value expected to have a specific value on affected systems?
Yes. For architectures whose raw branch records are already stored in age order, the documented hw_idx value should be 0. The fix zero-initializes the structure so hw_id is returned as zero.