CVE-2026-89460 - Vulnerability Details

- s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks

Description

In the Linux kernel, the following vulnerability has been resolved:

s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks

The command 'perf stat -e cycles -- <command>' crashes the kernel
when CPUs are hotplug added during that run.

Root cause is the allocation of struct cpu_cf_events at first
event initialization. The allocation is dynamic and the first
event that has task context creates such a structure for
each online CPU. This is not sufficient. CPUs may be offline
during event creation and can be set online during the
perf run time. For example commands

# echo 0 > /sys/devices/system/cpu/cpu1/online
# perf stat -e cycles -i -- stress-ng -t10s --matrix X
# sleep 1
# echo 1 > /sys/devices/system/cpu/cpu1/online

create an event for CPUs 0,2-X. Since the events are created with
task-context, the scheduler will eventually schedule the program
on CPU1. This CPU has not created and initialized any per
CPU event infrastructure as that CPU was not online at the time
of the perf invocation. Thus when the scheduler runs stress-ng
on CPU1, the function cpumf_pmu_add() refers to a NULL pointer:

struct cpu_cf_events *cpuhw = this_cpu_cfhw();

This function call is invoked after the task stress-ng has been
made runnable on CPU1. And this_cpu_cfhw() returns NULL.

The result is a panic:
Unable to handle kernel pointer dereference in virtual kernel address space
Failing address: 0000000000000000 TEID: 0000000000000483
....
Krnl PSW : 0404d00180000000 000003ef8291fd0c (cpumf_pmu_add+0x3c/0x80)
....
Call Trace:
[<000003ef8291fd0c>] cpumf_pmu_add+0x3c/0x80
[<000003ef82bb5e3e>] event_sched_in+0xae/0x190
[<000003ef82bb60d6>] merge_sched_in+0x1b6/0x390
[<000003ef82bb65b8>] visit_groups_merge.constprop.0.isra.0+0x308/0x5b0
[<000003ef82bb689a>] pmu_groups_sched_in+0x3a/0x50
[<000003ef82bb6a30>] ctx_sched_in+0x180/0x260
[<000003ef82bb780c>] perf_event_context_sched_in+0x11c/0x2d0
[<000003ef82bb79ee>] __perf_event_task_sched_in+0x2e/0xc0
[<000003ef82994834>] finish_task_switch.isra.0+0x1a4/0x250
....
Last Breaking-Event-Address:
[<000003ef8291f1d8>] this_cpu_cfhw+0x38/0x40

The issue arises only in per-task context when the CPUMF facility is
used and the scheduler picks a random CPU for such a process to run on.
The scheduler enables the CPUMF infrastructure via PMU callback
functions pmu::add() and pmu::del().

Introduce a CPU hotplug prepare/dead callback pair which creates and
removes the per CPU counter data while the CPU is offline. Count the
users which track every CPU (cpu == -1), that is perf_event_open()
events with task context and /dev/hwctr device sessions, in the new
counter cpu_cf_root::tskcnt, protected by pmc_reserve_mutex.
This ensures the infrastructure is available when
new CPU is selected to run the per-task context process.

In cpum_cf_free_root() and cpum_cf_free_cpu() ensure the reference
pointer to data structures is set to NULL before the data is freed
to prevent interrupt handlers to access stale data.

[gor@linux.ibm.com: change commit message]

Published: 2026-09-11

Score: 4.4 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The flaw causes a NULL pointer dereference in the s390 cpum_cf module of the Linux kernel. It can be triggered when perf stat commands with task context are run while CPUs are hot‑plugged offline and later brought online. The scheduler assumes per‑CPU counter data has been initialized but it has not, leading to a kernel panic. This results in a denial‑of‑service that brings the system down.CWE‑476).

Affected Systems

Affects the Linux kernel on s390 architectures. Specific version range is not listed, but the vulnerability exists before the commit that added hot‑plug prepare/dead callbacks to the cpum_cf subsystem.

Risk and Exploitability

The CVSS score of 4.4 indicates low to moderate severity. EPSS of <1% indicates a very low but non‑zero probability of exploitation and the flaw is not in CISA’s KEV catalog. The needs access to run perf commands and manipulate CPU online state. By inducing a kernel panic the attacker can cause a denial‑of‑service. Because exploitation requires local privilege or compromised access, the risk is confined to systems where such access is possible.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`9b9cf3c77e7e090b30657b3d2c288deb58dfb4f2`	affected	< 777d040c2f91d8d929b4a32333dfe4102b27caea
`9b9cf3c77e7e090b30657b3d2c288deb58dfb4f2`	affected	< dcce7a06ea690d5cf46a705a9b74cf0398ac091f
`9b9cf3c77e7e090b30657b3d2c288deb58dfb4f2`	affected	< 71d46de9153e067c63a15f3b00e6364e1c0230f8
`9b9cf3c77e7e090b30657b3d2c288deb58dfb4f2`	affected	< 337bd95507a16063687cfc286ea90de5cca48c37

Linux

affected

Version	Status	Constraints
`6.5`	affected	—
`0`	unaffected	< 6.5
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[9b9cf3c77e7e090b30657b3d2c288deb58dfb4f2,777d040c2f91d8d929b4a32333dfe4102b27caea)`	affected	code_commit	—
`[9b9cf3c77e7e090b30657b3d2c288deb58dfb4f2,dcce7a06ea690d5cf46a705a9b74cf0398ac091f)`	affected	code_commit	—
`[9b9cf3c77e7e090b30657b3d2c288deb58dfb4f2,71d46de9153e067c63a15f3b00e6364e1c0230f8)`	affected	code_commit	—
`[9b9cf3c77e7e090b30657b3d2c288deb58dfb4f2,337bd95507a16063687cfc286ea90de5cca48c37)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.5`	affected	generic	—
`[0,6.5)`	unaffected	generic	—
`[6.12.109,6.12.*]`	unaffected	generic	—
`[6.18.50,6.18.*]`	unaffected	generic	—
`[7.2.4,7.2.*]`	unaffected	generic	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply a Linux kernel update that contains the s390 cpum_cf hot‑plug fix.
Avoid running perf stat or other perf_event commands with task context while hot‑plugging CPUs; perform hot‑plug operations only when no performance monitoring is active.
If an update cannot be applied immediately, temporarily suspend CPU hot‑plug operations during perf tasks or disable perf events for the affected CPUs.

Generated by OpenCVE AI on September 13, 2026 at 03:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00168.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/337bd95507a16063687cfc286ea90de5cca48c37
https://git.kernel.org/stable/c/71d46de9153e067c63a15f3b00e6364e1c0230f8
https://git.kernel.org/stable/c/777d040c2f91d8d929b4a32333dfe4102b27caea
https://git.kernel.org/stable/c/dcce7a06ea690d5cf46a705a9b74cf0398ac091f
https://nvd.nist.gov/vuln/detail/CVE-2026-89460
https://www.cve.org/CVERecord?id=CVE-2026-89460

History

Sat, 12 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89460 https://www.cve.org/CVERecord?id=CVE-2026-89460
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks The command 'perf stat -e cycles -- <command>' crashes the kernel when CPUs are hotplug added during that run. Root cause is the allocation of struct cpu_cf_events at first event initialization. The allocation is dynamic and the first event that has task context creates such a structure for each online CPU. This is not sufficient. CPUs may be offline during event creation and can be set online during the perf run time. For example commands # echo 0 > /sys/devices/system/cpu/cpu1/online # perf stat -e cycles -i -- stress-ng -t10s --matrix X # sleep 1 # echo 1 > /sys/devices/system/cpu/cpu1/online create an event for CPUs 0,2-X. Since the events are created with task-context, the scheduler will eventually schedule the program on CPU1. This CPU has not created and initialized any per CPU event infrastructure as that CPU was not online at the time of the perf invocation. Thus when the scheduler runs stress-ng on CPU1, the function cpumf_pmu_add() refers to a NULL pointer: struct cpu_cf_events *cpuhw = this_cpu_cfhw(); This function call is invoked after the task stress-ng has been made runnable on CPU1. And this_cpu_cfhw() returns NULL. The result is a panic: Unable to handle kernel pointer dereference in virtual kernel address space Failing address: 0000000000000000 TEID: 0000000000000483 .... Krnl PSW : 0404d00180000000 000003ef8291fd0c (cpumf_pmu_add+0x3c/0x80) .... Call Trace: [<000003ef8291fd0c>] cpumf_pmu_add+0x3c/0x80 [<000003ef82bb5e3e>] event_sched_in+0xae/0x190 [<000003ef82bb60d6>] merge_sched_in+0x1b6/0x390 [<000003ef82bb65b8>] visit_groups_merge.constprop.0.isra.0+0x308/0x5b0 [<000003ef82bb689a>] pmu_groups_sched_in+0x3a/0x50 [<000003ef82bb6a30>] ctx_sched_in+0x180/0x260 [<000003ef82bb780c>] perf_event_context_sched_in+0x11c/0x2d0 [<000003ef82bb79ee>] __perf_event_task_sched_in+0x2e/0xc0 [<000003ef82994834>] finish_task_switch.isra.0+0x1a4/0x250 .... Last Breaking-Event-Address: [<000003ef8291f1d8>] this_cpu_cfhw+0x38/0x40 The issue arises only in per-task context when the CPUMF facility is used and the scheduler picks a random CPU for such a process to run on. The scheduler enables the CPUMF infrastructure via PMU callback functions pmu::add() and pmu::del(). Introduce a CPU hotplug prepare/dead callback pair which creates and removes the per CPU counter data while the CPU is offline. Count the users which track every CPU (cpu == -1), that is perf_event_open() events with task context and /dev/hwctr device sessions, in the new counter cpu_cf_root::tskcnt, protected by pmc_reserve_mutex. This ensures the infrastructure is available when new CPU is selected to run the per-task context process. In cpum_cf_free_root() and cpum_cf_free_cpu() ensure the reference pointer to data structures is set to NULL before the data is freed to prevent interrupt handlers to access stale data. [gor@linux.ibm.com: change commit message]
Title		s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/337bd95507a16063687cfc286ea90de5cca48c37 https://git.kernel.org/stable/c/71d46de9153e067c63a15f3b00e6364e1c0230f8 https://git.kernel.org/stable/c/777d040c2f91d8d929b4a32333dfe4102b27caea https://git.kernel.org/stable/c/dcce7a06ea690d5cf46a705a9b74cf0398ac091f

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:43:22.664Z

Updated: 2026-09-11T19:43:22.664Z

Reserved: 2026-09-11T19:38:34.708Z

Link: CVE-2026-89460

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:26.893

Modified: 2026-09-11T20:19:26.893

Link: CVE-2026-89460

Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:43:22Z

Links: CVE-2026-89460 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-13T16:30:13Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object