CVE-2026-97526: s390/pai: Support CPU hotplug for PMU PAI

Published Sep 25, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

s390/pai: Support CPU hotplug for PMU PAI

The command 'perf stat -e paicrypto/CRYPTOALL/ -- <command>' crashes the kernel when CPUs are hotplug added during that run.

Root cause is the missing allocation of per-CPU data structures for that new CPU. The allocation is dynamic and the first event that has task context creates such a structure for each online CPU. This is not sufficient. CPUs may be offline during event creation and can be set online during the perf run time. For example commands

# echo 0 > /sys/devices/system/cpu/cpu1/online # perf stat -e cycles -i -- stress-ng -t10s --matrix X # sleep 1 # echo 1 > /sys/devices/system/cpu/cpu1/online

Currently without a CPU hotplug handler, that new CPU has no per-CPU data infrastructure. The scheduler runs PMU call back function paiadd() to install the PMU support for that CPU before the task is being scheduled on that new CPU. In paiadd() instructions

mp = thiscpuptr(pairoot[idx].mapptr); cpump = mp->mapptr;

return a NULL pointer and the result is a kernel panic as variable cpump is used inside that function.

Add CPU hotplug support for CPU add and delete and create the necessary per-CPU data infrastructure during CPU hotplug add processing. Same for CPU hotplug remove. This is done when the CPU is offline to ensure the data structures are available when CPU is made online and tasks are scheduled on it.

[hca@linux.ibm.com: fixup error path in paiinit()]

Affected Software

1 affected component
Linux Linux kernel

Event History

Sep 25, 2026
CVE Published
via MITRE·10:21 AM
Data Sourced
via MITRE·10:21 AM
Description
Data Sourced
via NVD·11:17 AM
Description

Frequently Asked Questions

1

What conditions are required to trigger the kernel crash?

A PMU PAI perf event with task context must be running, and a CPU that was offline when the event's per-CPU data was created must be brought online during the run. The described trigger uses a PAI crypto event, but the example also shows the issue during a perf workload while CPU hotplug operations occur.

2

Who is realistically exposed to this issue?

Systems using the s390 PAI PMU feature and allowing CPUs to be offlined and onlined while relevant perf events are active are exposed. Systems that do not use PAI perf events or do not perform CPU hotplug during those runs are not described as affected.

3

What can be done if the fix cannot be applied immediately?

Avoid bringing CPUs online during active PAI PMU perf runs. In particular, do not start a perf event while CPUs are offline and then hotplug those CPUs online before the event completes.

4

How can an affected system be recognized?

The failure occurs when the scheduler invokes the PAI PMU callback for a newly online CPU that lacks its per-CPU data infrastructure. The result described is a NULL-pointer use in pai_add() and a kernel panic.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203