UBUNTU-CVE-2026-90272: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: perf: armpmuv3: Zero initialize hwid branch stack field PERFSAMPLEBRANCHHWINDEX is supported by BRBE so hwid is passed to userspace, but it's never set by the BRBE driver. Zero initialize it as it should be according to the docs: For the architectures whose raw branch records are already stored in age order, the hwidx should be 0. It's probably too risky to remove PERFSAMPLEBRANCHHWINDEX from BRBE now in case anyone is setting it and reading the value, but zero initializing the whole struct also protects against the same issue with new fields that are added in the future.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In the Linux kernel perf arm_pmuv3 BRBE driver, zero-initialize the entire branch record structure, including the hw_id field, so hw_idx is 0 for architectures whose raw branch records are already stored in age order.
Event History
Frequently Asked Questions
What conditions are required for the issue to affect perf output?
The system must use the Arm PMUv3 BRBE path and userspace must request PERF_SAMPLE_BRANCH_HW_INDEX. BRBE supports that sample field, causing hw_id to be passed to userspace.
How does the fix change the reported branch hardware index?
The BRBE driver now zero-initializes the branch-stack structure, so the hw_id field is set to 0. This matches the documented behavior for architectures whose raw branch records are already stored in age order.