Vulnerability in Linux

[ Description ]Official description

In the Linux kernel, the following vulnerability has been resolved: perf: Fix perf_pmu_migrate_context() leaving events behind __perf_pmu_remove() walks the group leaders of a CPU and PMU with perf_event_groups_for_cpu_pmu(), removing each one as it goes. perf_remove_from_context() takes the leader out of the groups rbtree, after which rb_next() on that node returns NULL, prematurely ending the walk. Other groups stay behind in the source context. On CPU hotplug, they are then torn down with the dying CPU. They keep running until teardown, while the PMU's interrupt and migrated events are on a new CPU, which drivers rely on never happening. Walk ctx->event_list instead and pick out the PMU's events by their pmu_ctx.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund28 Oct 2026WID-SEC-2026-4224

  Linux Kernel: Multiple vulnerabilities allow an unspecified attack Translated from German

  CVE-2026-99116CVE-2026-99143CVE-2026-99170+113 more CVEs

[ References ]References

• git.kernel.org/stable/c/3caf006eb731e88cbb33fb5b7d1f2fdb23712bc7
• git.kernel.org/stable/c/3eb08f09bfb364051f51316da873c3bd51a839ef
• git.kernel.org/stable/c/d4002e954c612dfc7e3fb5549e4a188ea281fe35
• git.kernel.org/stable/c/e76b36b4be7160eaa14b416681e548b125702395
• git.kernel.org/stable/c/f5f0028764de322a3d04eda0d3b6389ca9847446