CVE-2026-97499: coresight: perf: Retrieve path and source from event data
In the Linux kernel, the following vulnerability has been resolved:
coresight: perf: Retrieve path and source from event data
ETM perf callbacks currently use the per-CPU csdevsrc pointer, which can race with updates during device registration and unregistration.
The AUX setup already builds and stores the path in the event data. Use this path to retrieve the source instead of csdevsrc to avoid the race.
Export coresightgetsource() and add etmeventgetctxtpath() to retrieve the context's path and its source with READONCE() / WRITEONCE() accessors. Give the comments to explain why this approach is safe when pause or resume callbacks preempt the disable callback (e.g. via NMI).
Affected Software
Event History
Frequently Asked Questions
What systems are realistically exposed to this race condition?
The issue is in the Linux kernel CoreSight perf integration and involves ETM perf callbacks. Systems using CoreSight ETM tracing through perf are the relevant exposure set; the provided data does not identify affected kernel versions or hardware platforms.
What conditions are needed to trigger the issue?
The race involves ETM perf callbacks accessing a per-CPU source-device pointer while device registration or unregistration updates it. Callback activity, including pause or resume preempting disable callbacks such as through an NMI, is part of the concurrency scenario described.
What changes in the fix reduce the risk?
The fix retrieves the trace path and source from event data created during AUX setup rather than using the per-CPU csdev_src pointer. It also uses READ_ONCE() and WRITE_ONCE() accessors when retrieving the context path and source.