Live › vulnerability › CVE-2026-98937
Go to dashboardThe Linux kernel's perf_event_open() checked kernel profiling privilege only when kernel sampling was requested, not when kernel callchains were requested. A local user without kernel profiling privilege could therefore collect kernel call stacks.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel without this fix where local users can call perf_event_open(). The sources do not say which kernel versions are affected or whether restricted perf settings already block this path.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
perf/core: Check kernel access when kernel callchains are requested
perf_event_open() currently gates perf_allow_kernel() only on !attr.exclude_kernel.
However, users can still request kernel callchain collection with attr.exclude_callchain_kernel == 0 even when attr.exclude_kernel == 1. That still requires kernel profiling privilege, but the existing check does not enforce it.
Update the permission check to call perf_allow_kernel() when either kernel sampling is requested or kernel callchains are requested.
This keeps permission checks aligned with requested data and prevents unprivileged use of kernel callchain capture.
This page as .md · .json · in your agent: get_signal("CVE-2026-98937")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.