UBUNTU-CVE-2026-99187: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: perf: Fix perfpmumigratecontext() leaving events behind perfpmuremove() walks the group leaders of a CPU and PMU with perfeventgroupsforcpupmu(), removing each one as it goes. perfremovefromcontext() takes the leader out of the groups rbtree, after which rbnext() on that node returns NULL, prematurely ending the walk. Other groups stay behind in the source context. On CPU hotplug, they are then torn down with the dying CPU. They keep running until teardown, while the PMU's interrupt and migrated events are on a new CPU, which drivers rely on never happening. Walk ctx->eventlist instead and pick out the PMU's events by their pmuctx.
Affected Software
Event History
Frequently Asked Questions
When can this issue be triggered?
The affected path is exercised during CPU hotplug, when perf PMU contexts are migrated as a CPU is taken offline. It concerns systems using the Linux perf subsystem with events associated with a PMU on a hotplugged CPU.
What is the operational impact before the fix?
Some perf event groups can remain in the source context instead of being migrated. Those events may continue running until the CPU is torn down, while the PMU interrupt and migrated events are on a different CPU, violating assumptions relied on by PMU drivers.
Which Ubuntu kernel packages are identified as affected?
The listed packages are ubuntu/linux, ubuntu/linux-aws, ubuntu/linux-azure, ubuntu/linux-azure-fde, ubuntu/linux-gcp, ubuntu/linux-gke, ubuntu/linux-realtime, and ubuntu/linux-riscv.