CVE-2026-31528

Last refreshed2026-10-17

Status: UPDATED | Advisory ID: CVE-2026-31528

Key Details

CVE	CVE-2026-31528
CVSS Score / Version	7.8 (High) / CVSS v3.1
Updated	2026-10-16
CVSS Vector	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
CVSS Prose	attack vector is local; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	Linux Kernel
Classified as	CWE-125 (Out-of-bounds Read)

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

perf: Make sure to use pmu_ctx->pmu for groups

Oliver reported that x86_pmu_del() ended up doing an out-of-bound memory access

when group_sched_in() fails and needs to roll back.

This *should* be handled by the transaction callbacks, but he found that when

the group leader is a software event, the transaction handlers of the wrong PMU

are used. Despite the move_group case in perf_event_open() and group_sched_in()

using pmu_ctx->pmu.

Turns out, inherit uses event->pmu to clone the events, effectively undoing the

move_group case for all inherited contexts. Fix this by also making inherit use

pmu_ctx->pmu, ensuring all inherited counters end up in the same pmu context.

Similarly, __perf_event_read() should use equally use pmu_ctx->pmu for the

group case. (NVD)

Monitor Linux's web page for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-31528
CVE	https://www.cve.org/CVERecord?id=CVE-2026-31528

Source

Reference

NVD

CVE