UBUNTU-CVE-2026-97960: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Prevent drainpebs() reentry The PEBS buffer is shared by all events on a CPU, so drainpebs() must not be reentered. If so, one instance may observe stale buffer state and potentially access out-of-bound memory. Most invocations happen in NMI context, which naturally prevents reentry. However, drainpebs() is also reachable from process context via intelpmudrainpebsbuffer(). In those paths, the PMU is often already disabled, but not guaranteed. For example, intelpmupebsdisable() only disables the target counter, so other active counters can still raise a PMI and interrupt an in-flight drainpebs(). Here is an example, perfaddrfiltersadjust() perfeventstop() perfeventstop() x86pmustop() (event->pmu->stop) intelpmudisableevent() intelpmupebsdisable() intelpmupebsdisable() intelpmudrainlargepebs() intelpmudrainpebsbuffer() Introduce intelpmuquiesce() and intelpmuresume() helpers and use them in intelpmudrainlargepebs() to disable the full PMU around the intelpmudrainpebsbuffer() call, preventing reentry. Also add a warning in intelpmudrainpebsbuffer() when the full PMU is not disabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In intel_pmu_drain_large_pebs(), use __intel_pmu_quiesce() and __intel_pmu_resume() to disable and restore the full PMU around the intel_pmu_drain_pebs_buffer() call, preventing drain_pebs() reentry.
Event History
Frequently Asked Questions
What access and conditions does exploitation require?
An attacker needs local access with low privileges; no user interaction is required. Exploitation also depends on a timing or environmental condition, reflected by the attack requirements metric, where a PMI can interrupt an in-progress PEBS buffer drain.
Which systems are most relevant to triage?
The vulnerable code path concerns the Intel x86 PMU and PEBS buffer handling. The affected Ubuntu kernel package list includes linux-riscv, linux-realtime, linux-azure, linux-gcp, linux-azure-fde, linux-gke, linux-hwe-edge, and linux-gkeop.
What change resolves the issue?
The fix quiesces the full PMU before draining the large PEBS buffer and resumes it afterward. This prevents a performance-monitoring interrupt from reentering the drain routine while it is already running.