CVE-2026-98937

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: perf/core: Check kernel access when kernel callchains are requested perf_event_open() currently gates perf_allow_kernel() only on !attr.exclude_kernel. However, users can still request kernel callchain collection with attr.exclude_callchain_kernel == 0 even when attr.exclude_kernel == 1. That still requires kernel profiling privilege, but the existing check does not enforce it. Update the permission check to call perf_allow_kernel() when either kernel sampling is requested or kernel callchains are requested. This keeps permission checks aligned with requested data and prevents unprivileged use of kernel callchain capture.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Received

Source identifier

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Published

2026-10-23 13:17:14.613000

Last modified

2026-10-26 07:17:17.870000

View original CVE JSON

{
  "id": "CVE-2026-98937",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2026-10-23T13:17:14.613",
  "lastModified": "2026-10-26T07:17:17.870",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/core: Check kernel access when kernel callchains are requested\n\nperf_event_open() currently gates perf_allow_kernel() only on\n!attr.exclude_kernel.\n\nHowever, users can still request kernel callchain collection with\nattr.exclude_callchain_kernel == 0 even when attr.exclude_kernel == 1.\nThat still requires kernel profiling privilege, but the existing check\ndoes not enforce it.\n\nUpdate the permission check to call perf_allow_kernel() when either\nkernel sampling is requested or kernel callchains are requested.\n\nThis keeps permission checks aligned with requested data and prevents\nunprivileged use of kernel callchain capture."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "kernel/events/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "0764771dab80d7b84b9a271bee7f1b21a04a3f0c",
              "lessThan": "132bee76097be421ab3012130b5b506324cf2be1",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "0764771dab80d7b84b9a271bee7f1b21a04a3f0c",
              "lessThan": "2581b43e162cfc43e6f5d8dd8d2b38f3441550de",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "0764771dab80d7b84b9a271bee7f1b21a04a3f0c",
              "lessThan": "6e187281f978a2bff98ead6aa40f8ddc9a2c9afb",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "0764771dab80d7b84b9a271bee7f1b21a04a3f0c",
              "lessThan": "a4573a3838ae4fc73b70019cfa1dac9aaea7cc2f",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "kernel/events/core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "2.6.31",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "2.6.31",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.113",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18.56",
              "lessThanOrEqual": "6.18.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.2.10",
              "lessThanOrEqual": "7.2.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.3",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/132bee76097be421ab3012130b5b506324cf2be1",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/2581b43e162cfc43e6f5d8dd8d2b38f3441550de",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/6e187281f978a2bff98ead6aa40f8ddc9a2c9afb",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a4573a3838ae4fc73b70019cfa1dac9aaea7cc2f",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}