CVE-2026-31528 - Vulnerability Details

- perf: Make sure to use pmu_ctx->pmu for groups

Description

In the Linux kernel, the following vulnerability has been resolved:

perf: Make sure to use pmu_ctx->pmu for groups

Oliver reported that x86_pmu_del() ended up doing an out-of-bound memory access
when group_sched_in() fails and needs to roll back.

This *should* be handled by the transaction callbacks, but he found that when
the group leader is a software event, the transaction handlers of the wrong PMU
are used. Despite the move_group case in perf_event_open() and group_sched_in()
using pmu_ctx->pmu.

Turns out, inherit uses event->pmu to clone the events, effectively undoing the
move_group case for all inherited contexts. Fix this by also making inherit use
pmu_ctx->pmu, ensuring all inherited counters end up in the same pmu context.

Similarly, __perf_event_read() should use equally use pmu_ctx->pmu for the
group case.

Published: 2026-04-22

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The flaw is in the Linux kernel’s perf subsystem. When a group operation rolls back, the code uses the wrong PMU context, causing an out‑of‑bounds memory access that corrupts kernel data structures. This memory corruption could let a local attacker tamper with kernel state or cause a denial of service.

Affected Systems

All Linux kernel builds that incorporate the kernel version before the commit that fixes the bug (35f7914e54fe7f13654c22ee045b05e4b6d8062b). Because the advisory lists only the generic Linux kernel CPE, any distribution using a derivative of that version is potentially vulnerable until an update is applied.

Risk and Exploitability

The EPSS score remains <1% and the vulnerability is not listed in the CISA KEV catalog. The CVSS score is 7.8, indicating a high severity. This out-of-bound memory access requires local interaction with the perf subsystem; an attacker with sufficient privilege can trigger the error, potentially leading to kernel memory corruption and denial of service.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`bd27568117664b8b3e259721393df420ed51f57b`	affected	< 656f35b463995bee024d948440128230aacd81e1
`bd27568117664b8b3e259721393df420ed51f57b`	affected	< 3a696e84a8b1fafdd774bb30d62919faf844d9e4
`bd27568117664b8b3e259721393df420ed51f57b`	affected	< 35f7914e54fe7f13654c22ee045b05e4b6d8062b
`bd27568117664b8b3e259721393df420ed51f57b`	affected	< 4c759446046500a1a6785b25725725c3ff087ace
`bd27568117664b8b3e259721393df420ed51f57b`	affected	< 4b9ce671960627b2505b3f64742544ae9801df97

Linux

affected

Version	Status	Constraints
`6.2`	affected	—
`0`	unaffected	< 6.2
`6.6.131`	unaffected	≤ 6.6.*
`6.12.80`	unaffected	≤ 6.12.*
`6.18.21`	unaffected	≤ 6.18.*
`6.19.11`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc2::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc3::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc4::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[bd27568117664b8b3e259721393df420ed51f57b,656f35b463995bee024d948440128230aacd81e1]`	affected	code_commit	—
`[bd27568117664b8b3e259721393df420ed51f57b,3a696e84a8b1fafdd774bb30d62919faf844d9e4]`	affected	code_commit	—
`[bd27568117664b8b3e259721393df420ed51f57b,35f7914e54fe7f13654c22ee045b05e4b6d8062b]`	affected	code_commit	—
`[bd27568117664b8b3e259721393df420ed51f57b,4c759446046500a1a6785b25725725c3ff087ace]`	affected	code_commit	—
`[bd27568117664b8b3e259721393df420ed51f57b,4b9ce671960627b2505b3f64742544ae9801df97]`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.2`	affected	generic	—
`[0,6.2)`	unaffected	generic	—
`[6.6.131,6.7.0)`	unaffected	semver	—
`[6.12.80,6.13.0)`	unaffected	semver	—
`[6.18.21,6.19.0)`	unaffected	semver	—
`[6.19.11,6.20.0)`	unaffected	semver	—
`[7.0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the kernel to a version that includes the fix from commit 35f7914e54fe7f13654c22ee045b05e4b6d8062b following your distribution’s normal update procedures.
If a patched package is not yet available from your vendor, download the Linux kernel source, apply the patch that implements the change, rebuild the kernel, and install the new image.
As a temporary countermeasure, limit or disable the perf_event subsystem for untrusted users, for example by removing the perf_event_open capability from user namespaces or configuring systemd sandboxing to block access to that system call.

Generated by OpenCVE AI on April 28, 2026 at 20:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6238-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00015.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/35f7914e54fe7f13654c22ee045b05e4b6d8062b
https://git.kernel.org/stable/c/3a696e84a8b1fafdd774bb30d62919faf844d9e4
https://git.kernel.org/stable/c/4b9ce671960627b2505b3f64742544ae9801df97
https://git.kernel.org/stable/c/4c759446046500a1a6785b25725725c3ff087ace
https://git.kernel.org/stable/c/656f35b463995bee024d948440128230aacd81e1
https://lore.kernel.org/linux-cve-announce/2026042214-CVE-2026-31528-b375@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-31528
https://www.cve.org/CVERecord?id=CVE-2026-31528

History

Tue, 28 Apr 2026 18:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125
CPEs		cpe:2.3:o:linux:linux_kernel:7.0:rc1:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc2:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc3:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc4::::::

Mon, 27 Apr 2026 15:00:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Thu, 23 Apr 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-787
References		https://lore.kernel.org/linux-cve-announce/2026042214-CVE-2026-31528-b375@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-31528 https://www.cve.org/CVERecord?id=CVE-2026-31528
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Wed, 22 Apr 2026 14:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: perf: Make sure to use pmu_ctx->pmu for groups Oliver reported that x86_pmu_del() ended up doing an out-of-bound memory access when group_sched_in() fails and needs to roll back. This should be handled by the transaction callbacks, but he found that when the group leader is a software event, the transaction handlers of the wrong PMU are used. Despite the move_group case in perf_event_open() and group_sched_in() using pmu_ctx->pmu. Turns out, inherit uses event->pmu to clone the events, effectively undoing the move_group case for all inherited contexts. Fix this by also making inherit use pmu_ctx->pmu, ensuring all inherited counters end up in the same pmu context. Similarly, __perf_event_read() should use equally use pmu_ctx->pmu for the group case.
Title		perf: Make sure to use pmu_ctx->pmu for groups
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/35f7914e54fe7f13654c22ee045b05e4b6d8062b https://git.kernel.org/stable/c/3a696e84a8b1fafdd774bb30d62919faf844d9e4 https://git.kernel.org/stable/c/4b9ce671960627b2505b3f64742544ae9801df97 https://git.kernel.org/stable/c/4c759446046500a1a6785b25725725c3ff087ace https://git.kernel.org/stable/c/656f35b463995bee024d948440128230aacd81e1

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-04-22T13:54:41.180Z

Updated: 2026-05-11T22:10:32.460Z

Reserved: 2026-03-09T15:48:24.111Z

Link: CVE-2026-31528

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-04-22T14:16:53.040

Modified: 2026-04-28T18:00:28.390

Link: CVE-2026-31528

Redhat

Severity : Moderate

Publid Date: 2026-04-22T00:00:00Z

Links: CVE-2026-31528 - Bugzilla

OpenCVE Enrichment

Updated: 2026-04-28T20:45:16Z

Weaknesses

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object