{"id":"CVE-2026-98937","kind":"vulnerability","aliases":["CVE-2026-98937"],"related":[],"title":"Linux perf: unprivileged users can capture kernel callchains without permission","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nperf/core: Check kernel access when kernel callchains are requested\n\nperf_event_open() currently gates perf_allow_kernel() only on\n!attr.exclude_kernel.\n\nHowever, users can still request kernel callchain collection with\nattr.exclude_callchain_kernel == 0 even when attr.exclude_kernel == 1.\nThat still requires kernel profiling privilege, but the existing check\ndoes not enforce it.\n\nUpdate the permission check to call perf_allow_kernel() when either\nkernel sampling is requested or kernel callchains are requested.\n\nThis keeps permission checks aligned with requested data and prevents\nunprivileged use of kernel callchain capture.","summary":"The Linux kernel's perf_event_open() checked kernel profiling privilege only when kernel sampling was requested, not when kernel callchains were requested. A local user without kernel profiling privilege could therefore collect kernel call stacks.","severity":"unknown","cvss":null,"epss":0.00209,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","kernel","linux","local-users"],"not_affected_if":["patched-kernel"],"how_to_check":"- unknown","fix":"- Update to a Linux kernel release that includes the upstream fix (perf/core: Check kernel access when kernel callchains are requested); the fixed version numbers are unknown from the sources.","status":"open","published_at":"2026-10-23T13:17:14+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:58:06+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T04:58:06Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel release that includes the upstream fix (perf/core: Check kernel access when kernel callchains are requested); the fixed version numbers are unknown from the sources.","reach":"local","title":"Linux perf: unprivileged users can capture kernel callchains without permission","impact":"low","summary":"The Linux kernel's perf_event_open() checked kernel profiling privilege only when kernel sampling was requested, not when kernel callchains were requested. A local user without kernel profiling privilege could therefore collect kernel call stacks.","category":"infrastructure","nicknames":[],"who_cares":["linux","kernel","local-users"],"confidence":0.6,"needs_auth":"yes","worst_case":"local user reads kernel call stacks without profiling privilege","analyst_note":"Check the NVD entry or the kernel stable commit for affected and fixed kernel versions and the CVSS score.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["patched-kernel"],"who_is_affected":"Systems running a Linux kernel without this fix where local users can call perf_event_open(). The sources do not say which kernel versions are affected or whether restricted perf settings already block this path.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000574,"input_tokens":3449,"output_tokens":459,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98937':13A,16A '0':102C '1':107C 'access':72C 'align':146C 'allow':84C,129C 'attr.exclude':88C,99C,105C 'call':57B,127C 'callchain':8A,43B,75C,96C,100C,139C,156C 'captur':6A,157C 'check':30B,70C,117C,125C,145C 'collect':55B,97C 'could':53B 'current':81C 'cve':11A,14A 'data':149C 'either':132C 'enforc':120C 'even':103C 'event':28B,79C 'exist':116C 'follow':64C 'gate':82C 'howev':90C 'infrastructur':17B 'keep':143C 'kernel':7A,18B,25B,31B,36B,42B,50B,56B,62C,71C,74C,85C,89C,95C,101C,106C,111C,130C,133C,138C,155C 'linux':1A,19B,24B,61C 'local':21B,47B 'local-us':20B 'open':29B,80C 'perf':2A,27B,78C,83C,128C 'perf/core':69C 'permiss':10A,124C,144C 'prevent':151C 'privileg':33B,52B,113C 'profil':32B,51B,112C 'request':39B,45B,77C,94C,136C,141C,148C 'requir':110C 'resolv':68C 'sampl':37B,134C 'stack':58B 'still':93C,109C 'therefor':54B 'unprivileg':3A,152C 'updat':122C 'use':153C 'user':4A,22B,48B,91C 'vulner':65C 'without':9A,49B","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel without this fix where local users can call perf_event_open(). The sources do not say which kernel versions are affected or whether restricted perf settings already block this path.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:14+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98937","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98937","severity":null,"published_at":"2026-10-23T13:17:14+00:00","modified_at":"2026-10-23T13:17:14+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-98937","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98937","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}