CVE-2026-97960: perf/x86/intel: Prevent drain_pebs() reentry
In the Linux kernel, the following vulnerability has been resolved:
perf/x86/intel: Prevent drainpebs() reentry
The PEBS buffer is shared by all events on a CPU, so drainpebs() must not be reentered. If so, one instance may observe stale buffer state and potentially access out-of-bound memory.
Most invocations happen in NMI context, which naturally prevents reentry. However, drainpebs() is also reachable from process context via intelpmudrainpebsbuffer().
In those paths, the PMU is often already disabled, but not guaranteed. For example, intelpmupebsdisable() only disables the target counter, so other active counters can still raise a PMI and interrupt an in-flight drainpebs(). Here is an example,
perfaddrfiltersadjust() perfeventstop() perfeventstop() x86pmustop() (event->pmu->stop) intelpmudisableevent() intelpmupebsdisable() intelpmupebsdisable() intelpmudrainlargepebs() intelpmudrainpebsbuffer()
Introduce intelpmuquiesce() and intelpmuresume() helpers and use them in intelpmudrainlargepebs() to disable the full PMU around the intelpmudrainpebsbuffer() call, preventing reentry.
Also add a warning in intelpmudrainpebsbuffer() when the full PMU is not disabled.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to the reentry condition?
The issue applies to Linux kernel systems using the Intel x86 PMU PEBS functionality. The vulnerable path is reachable when PEBS buffer draining occurs from process context rather than only from its usual NMI context.
What conditions are needed for the unsafe reentry to occur?
A process-context call to intel_pmu_drain_pebs_buffer() must be interrupted by a performance-monitoring interrupt while drain_pebs() is already in progress. Disabling only the target counter is insufficient because other active counters can still raise a PMI.
What does the fix do?
The fix disables the full PMU around the process-context PEBS buffer drain, then resumes it afterward. This prevents another PMI from reentering drain_pebs() and observing stale shared-buffer state.