CVE-2026-97526: s390/pai: Support CPU hotplug for PMU PAI
In the Linux kernel, the following vulnerability has been resolved:
s390/pai: Support CPU hotplug for PMU PAI
The command 'perf stat -e paicrypto/CRYPTOALL/ -- <command>' crashes the kernel when CPUs are hotplug added during that run.
Root cause is the missing allocation of per-CPU data structures for that new CPU. The allocation is dynamic and the first event that has task context creates such a structure for each online CPU. This is not sufficient. CPUs may be offline during event creation and can be set online during the perf run time. For example commands
# echo 0 > /sys/devices/system/cpu/cpu1/online # perf stat -e cycles -i -- stress-ng -t10s --matrix X # sleep 1 # echo 1 > /sys/devices/system/cpu/cpu1/online
Currently without a CPU hotplug handler, that new CPU has no per-CPU data infrastructure. The scheduler runs PMU call back function paiadd() to install the PMU support for that CPU before the task is being scheduled on that new CPU. In paiadd() instructions
mp = thiscpuptr(pairoot[idx].mapptr); cpump = mp->mapptr;
return a NULL pointer and the result is a kernel panic as variable cpump is used inside that function.
Add CPU hotplug support for CPU add and delete and create the necessary per-CPU data infrastructure during CPU hotplug add processing. Same for CPU hotplug remove. This is done when the CPU is offline to ensure the data structures are available when CPU is made online and tasks are scheduled on it.
[hca@linux.ibm.com: fixup error path in paiinit()]
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger the kernel crash?
A PMU PAI perf event with task context must be running, and a CPU that was offline when the event's per-CPU data was created must be brought online during the run. The described trigger uses a PAI crypto event, but the example also shows the issue during a perf workload while CPU hotplug operations occur.
Who is realistically exposed to this issue?
Systems using the s390 PAI PMU feature and allowing CPUs to be offlined and onlined while relevant perf events are active are exposed. Systems that do not use PAI perf events or do not perform CPU hotplug during those runs are not described as affected.
What can be done if the fix cannot be applied immediately?
Avoid bringing CPUs online during active PAI PMU perf runs. In particular, do not start a perf event while CPUs are offline and then hotplug those CPUs online before the event completes.
How can an affected system be recognized?
The failure occurs when the scheduler invokes the PAI PMU callback for a newly online CPU that lacks its per-CPU data infrastructure. The result described is a NULL-pointer use in pai_add() and a kernel panic.