CVE-2026-72237 - Vulnerability Details

- perf/x86/amd/brs: Fix kernel address leakage

Description

In the Linux kernel, the following vulnerability has been resolved:

perf/x86/amd/brs: Fix kernel address leakage

A user-only branch stack can contain branches that originate from
the kernel. As a result, kernel addresses are exposed to user space
even when PERF_SAMPLE_BRANCH_USER is requested. On AMD processors
supporting X86_FEATURE_BRS (Zen 3 only), perf can still report entries
such as SYSRET/interrupt returns for which the branch-from addresses
are in the kernel.

E.g.

$ perf record -j any,u -c 4000 -e branch-brs -o - -- \
perf bench syscall basic --loop 1000 | \
perf script -i - -F brstack|tr ' ' '\n'| \
grep -E '0x[89a-f][0-9a-f]{15}'

...
0xffffffff810001c4/0x72e2e32955eb/-/-/-/0//-
0xffffffff810001c4/0x72e2d94a9821/-/-/-/0//-
0xffffffff810001c4/0x72e2d94ffa1b/-/-/-/0//-
...

BRS provides no hardware branch filtering, so privilege level
filtering is performed entirely in software. However, amd_brs_match_plm()
only validates the branch-to address against the requested privilege
levels. For branches from the kernel to user space, the branch-from
address is left unchecked and is leaked. Extend the software filter to
also validate the branch-from address, so that any branch record whose
branch-from address is in the kernel is dropped when
PERF_SAMPLE_BRANCH_USER is requested.

Published: 2026-08-15

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

In Linux kernel versions that support AMD BRS, a user‑space request to perf for branch‑stack samples can reveal kernel memory addresses because the branch‑from address is not checked against the requested privilege level. This flaw allows any local user who can run perf to learn the layout and addresses of kernel code, providing information that may aid subsequent attacks. The weakness is an Information‑Disclosure vulnerability (CWE‑1220).

Affected Systems

All Linux kernel implementations running on AMD Zen 3 processors with branch stack sampling enabled (PERF_SAMPLE_BRANCH_USER). The advisory does not specify exact kernel versions, but the patch is included in recent releases, affecting any kernel that exposes BRS for user‑space sampling.

Risk and Exploitability

The CVSS score of 5.5 indicates medium severity, and the EPSS score of less than 1% suggests a very low but non‑zero likelihood of exploitation. The flaw is not listed in the CISA KEV catalog. A local privileged user can trigger the leak by executing perf with the -j any,u option or other branch‑stack sampling settings. Because the data path is local, remote exploitation is not possible, but the information disclosure can weaken mitigation defenses such as address space layout randomization.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`8910075d61a37e5b0d82e6c83ed9a0a31fe9ea08`	affected	< 4f949bc3913a6e3ce3b8574ac6ed1da8ec7a5ad1
`8910075d61a37e5b0d82e6c83ed9a0a31fe9ea08`	affected	< ac44b4a3d6137489f8fa2e794b12e849c6b22eaa
`8910075d61a37e5b0d82e6c83ed9a0a31fe9ea08`	affected	< 90843d00dbc61220b66408ea0d8775cae9e51f70
`8910075d61a37e5b0d82e6c83ed9a0a31fe9ea08`	affected	< 046f6244da9b68e463a849b21446b9424e531491
`8910075d61a37e5b0d82e6c83ed9a0a31fe9ea08`	affected	< 2e706be56f418718bb3ae66c0aa94f9b61150e6d
`8910075d61a37e5b0d82e6c83ed9a0a31fe9ea08`	affected	< 47915e855fb38b42133e31ba917d99565f862154

Linux

affected

Version	Status	Constraints
`5.19`	affected	—
`0`	unaffected	< 5.19
`6.1.183`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.97`	unaffected	≤ 6.12.*
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[8910075d61a37e5b0d82e6c83ed9a0a31fe9ea08,ac44b4a3d6137489f8fa2e794b12e849c6b22eaa)`	affected	code_commit	—
`[8910075d61a37e5b0d82e6c83ed9a0a31fe9ea08,90843d00dbc61220b66408ea0d8775cae9e51f70)`	affected	code_commit	—
`[8910075d61a37e5b0d82e6c83ed9a0a31fe9ea08,046f6244da9b68e463a849b21446b9424e531491)`	affected	code_commit	—
`[8910075d61a37e5b0d82e6c83ed9a0a31fe9ea08,2e706be56f418718bb3ae66c0aa94f9b61150e6d)`	affected	code_commit	—
`[8910075d61a37e5b0d82e6c83ed9a0a31fe9ea08,47915e855fb38b42133e31ba917d99565f862154)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.19`	affected	generic	—
`[0,5.19)`	unaffected	generic	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.97,6.13.0)`	unaffected	semver	—
`[6.18.40,6.19.0)`	unaffected	semver	—
`[7.1.5,7.2.0)`	unaffected	semver	—
`[7.2-rc3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the latest Linux kernel update that incorporates the perf/x86/amd/brs patch.
If an upgrade cannot be performed immediately, disable PERF_SAMPLE_BRANCH_USER or remove the any,u option from perf to prevent user‑space collection of kernel branch data.
Configure the kernel to disable AMD BRS entirely or enable hardware branch filtering where supported to eliminate the software filtering oversight.

Generated by OpenCVE AI on August 18, 2026 at 19:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00206.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/046f6244da9b68e463a849b21446b9424e531491
https://git.kernel.org/stable/c/2e706be56f418718bb3ae66c0aa94f9b61150e6d
https://git.kernel.org/stable/c/47915e855fb38b42133e31ba917d99565f862154
https://git.kernel.org/stable/c/4f949bc3913a6e3ce3b8574ac6ed1da8ec7a5ad1
https://git.kernel.org/stable/c/90843d00dbc61220b66408ea0d8775cae9e51f70
https://git.kernel.org/stable/c/ac44b4a3d6137489f8fa2e794b12e849c6b22eaa
https://lore.kernel.org/linux-cve-announce/2026081550-CVE-2026-72237-ef81@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-72237
https://www.cve.org/CVERecord?id=CVE-2026-72237

History

Wed, 19 Aug 2026 16:45:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/4f949bc3913a6e3ce3b8574ac6ed1da8ec7a5ad1

Tue, 18 Aug 2026 15:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-200 CWE-284

Tue, 18 Aug 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-1220
References		https://lore.kernel.org/linux-cve-announce/2026081550-CVE-2026-72237-ef81@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-72237 https://www.cve.org/CVERecord?id=CVE-2026-72237
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sat, 15 Aug 2026 10:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-200 CWE-284

Sat, 15 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd/brs: Fix kernel address leakage A user-only branch stack can contain branches that originate from the kernel. As a result, kernel addresses are exposed to user space even when PERF_SAMPLE_BRANCH_USER is requested. On AMD processors supporting X86_FEATURE_BRS (Zen 3 only), perf can still report entries such as SYSRET/interrupt returns for which the branch-from addresses are in the kernel. E.g. $ perf record -j any,u -c 4000 -e branch-brs -o - -- \ perf bench syscall basic --loop 1000 \| \ perf script -i - -F brstack\|tr ' ' '\n'\| \ grep -E '0x[89a-f][0-9a-f]{15}' ... 0xffffffff810001c4/0x72e2e32955eb/-/-/-/0//- 0xffffffff810001c4/0x72e2d94a9821/-/-/-/0//- 0xffffffff810001c4/0x72e2d94ffa1b/-/-/-/0//- ... BRS provides no hardware branch filtering, so privilege level filtering is performed entirely in software. However, amd_brs_match_plm() only validates the branch-to address against the requested privilege levels. For branches from the kernel to user space, the branch-from address is left unchecked and is leaked. Extend the software filter to also validate the branch-from address, so that any branch record whose branch-from address is in the kernel is dropped when PERF_SAMPLE_BRANCH_USER is requested.
Title		perf/x86/amd/brs: Fix kernel address leakage
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/046f6244da9b68e463a849b21446b9424e531491 https://git.kernel.org/stable/c/2e706be56f418718bb3ae66c0aa94f9b61150e6d https://git.kernel.org/stable/c/47915e855fb38b42133e31ba917d99565f862154 https://git.kernel.org/stable/c/90843d00dbc61220b66408ea0d8775cae9e51f70 https://git.kernel.org/stable/c/ac44b4a3d6137489f8fa2e794b12e849c6b22eaa

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:54:26.685Z

Updated: 2026-08-19T16:36:31.271Z

Reserved: 2026-08-09T03:40:39.914Z

Link: CVE-2026-72237

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T06:21:50.733

Modified: 2026-08-19T17:21:00.693

Link: CVE-2026-72237

Redhat

Severity : Moderate

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-72237 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-18T19:45:03Z

Weaknesses

CWE-1220
Insufficient Granularity of Access Control

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object