{"id":"CVE-2026-99125","kind":"vulnerability","aliases":["CVE-2026-99125"],"related":[],"title":"Linux kernel s390 PAI perf: double PMU stop call corrupts sampling state","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ns390/pai: Handle multiple PMU stop callback invocations\n\nHandle the following scenario:\nThe kernel protects itself against a very high sampling load and\nthrottles the sampling using:\n\n  perf_event_throttle() --> PMU->stop()\n\nShortly later the scheduler may terminate the task and removes it from the\nCPU. It again calls\n\n  PMU->stop()\n\nwhich results in two invocations of PMU->stop() called back to back.\nProtect against this and check the PERF_HES_STOPPED bit on function\nentry.  If it is already set return.\nClear bit PERF_HES_STOPPED in PMU->start().\n\nProhibit ioctl(fd, PERF_EVENT_IOC_PERIOD, ...) call for this event.\nIt sets perf_event::event_limit to a positive value and causes\nperf_event_overflow() to invoke pai_stop() call back function when\nperf_event::event_limit hits zero. This is not supported because the\nsample events CRYPTO_ALL and NNPA_ALL are only taken at schedule out\nof a task.\n\nUse list_for_each_entry_safe() for safe iteration over syswide_list\nin pai_have_samples().","summary":"The s390 PAI performance monitoring driver in the Linux kernel could receive two back-to-back PMU stop callbacks when sampling was throttled and a task was then removed from the CPU. The sources do not describe an attacker outcome beyond a kernel driver state fix.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ibm-z","infrastructure","linux-kernel","s390"],"not_affected_if":["non-s390-architecture"],"how_to_check":"- unknown","fix":"- Update to a Linux kernel release that includes the upstream commit for s390/pai multiple PMU stop handling (the sources do not name a version).","status":"open","published_at":"2026-10-28T11:17:32+00:00","first_seen_at":"2026-10-28T11:32:35+00:00","triaged_at":"2026-10-28T11:37:29+00:00","updated_at":"2026-10-28T11:37:29+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-28T11:37:29Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel release that includes the upstream commit for s390/pai multiple PMU stop handling (the sources do not name a version).","reach":"local","title":"Linux kernel s390 PAI perf: double PMU stop call corrupts sampling state","impact":"low","summary":"The s390 PAI performance monitoring driver in the Linux kernel could receive two back-to-back PMU stop callbacks when sampling was throttled and a task was then removed from the CPU. The sources do not describe an attacker outcome beyond a kernel driver state fix.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","s390","ibm-z"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown kernel impact; the sources describe a state-handling bug only","analyst_note":"Check the NVD entry and the upstream kernel commit for the exact impact and fixed kernel versions.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["non-s390-architecture"],"who_is_affected":"Systems running the Linux kernel on IBM Z (s390) hardware with the PAI perf PMU driver in use. Other architectures and kernels without this driver are not affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000599,"input_tokens":3623,"output_tokens":473,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-99125':15A,18A 'alreadi':162C 'attack':66B 'back':41B,43B,143C,145C,204C 'back-to-back':40B 'beyond':68B 'bit':155C,166C 'call':9A,131C,142C,180C,203C 'callback':46B,89C 'caus':195C 'check':150C 'clear':165C 'corrupt':10A 'could':37B 'cpu':59B,128C 'crypto':221C 'cve':13A,16A 'describ':64B 'doubl':6A 'driver':32B,71B 'entri':158C,239C 'event':111C,177C,183C,187C,188C,197C,208C,209C,220C 'fd':175C 'fix':73B 'follow':79C,93C 'function':157C,205C 'handl':85C,91C 'hes':153C,168C 'high':102C 'hit':211C 'ibm':20B 'ibm-z':19B 'infrastructur':22B 'invoc':90C,138C 'invok':200C 'ioc':178C 'ioctl':174C 'iter':243C 'kernel':2A,25B,36B,70B,77C,96C 'later':116C 'limit':189C,210C 'linux':1A,24B,35B,76C 'linux-kernel':23B 'list':236C,246C 'load':104C 'may':119C 'monitor':31B 'multipl':86C 'nnpa':224C 'outcom':67B 'overflow':198C 'pai':4A,29B,201C,248C 'perf':5A,110C,152C,167C,176C,186C,196C,207C 'perform':30B 'period':179C 'pmu':7A,44B,87C,113C,132C,140C,171C 'posit':192C 'prohibit':173C 'protect':97C,146C 'receiv':38B 'remov':56B,124C 'resolv':83C 'result':135C 'return':164C 's390':3A,26B,28B 's390/pai':84C 'safe':240C,242C 'sampl':11A,48B,103C,108C,219C,250C 'scenario':94C 'schedul':118C,230C 'set':163C,185C 'short':115C 'sourc':61B 'start':172C 'state':12A,72B 'stop':8A,45B,88C,114C,133C,141C,154C,169C,202C 'support':216C 'syswid':245C 'taken':228C 'task':53B,122C,234C 'termin':120C 'throttl':50B,106C,112C 'two':39B,137C 'use':109C,235C 'valu':193C 'vulner':80C 'z':21B 'zero':212C","nicknames":[],"mitigations":[],"who_affected":"Systems running the Linux kernel on IBM Z (s390) hardware with the PAI perf PMU driver in use. Other architectures and kernels without this driver are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:32+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99125","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99125","severity":null,"published_at":"2026-10-28T11:17:32+00:00","modified_at":"2026-10-28T11:17:32+00:00","first_seen_at":"2026-10-28T11:32:35+00:00","fetched_at":"2026-10-28T11:32:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}