perf/x86/amd/brs: Fix kernel address leakage
Summary
| CVE | CVE-2026-72237 |
|---|
| State | PUBLISHED |
|---|
| Assigner | Linux |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2026-08-15 06:21:50 UTC |
|---|
| Updated | 2026-08-15 06:21:50 UTC |
|---|
| Description | In the Linux kernel, the following vulnerability has been resolved:
perf/x86/amd/brs: Fix kernel address leakage
A user-only branch stack can contain branches that originate from
the kernel. As a result, kernel addresses are exposed to user space
even when PERF_SAMPLE_BRANCH_USER is requested. On AMD processors
supporting X86_FEATURE_BRS (Zen 3 only), perf can still report entries
such as SYSRET/interrupt returns for which the branch-from addresses
are in the kernel.
E.g.
$ perf record -j any,u -c 4000 -e branch-brs -o - -- \
perf bench syscall basic --loop 1000 | \
perf script -i - -F brstack|tr ' ' '\n'| \
grep -E '0x[89a-f][0-9a-f]{15}'
...
0xffffffff810001c4/0x72e2e32955eb/-/-/-/0//-
0xffffffff810001c4/0x72e2d94a9821/-/-/-/0//-
0xffffffff810001c4/0x72e2d94ffa1b/-/-/-/0//-
...
BRS provides no hardware branch filtering, so privilege level
filtering is performed entirely in software. However, amd_brs_match_plm()
only validates the branch-to address against the requested privilege
levels. For branches from the kernel to user space, the branch-from
address is left unchecked and is leaked. Extend the software filter to
also validate the branch-from address, so that any branch record whose
branch-from address is in the kernel is dropped when
PERF_SAMPLE_BRANCH_USER is requested. |
|---|
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|
| CNA |
Linux |
Linux |
affected 8910075d61a37e5b0d82e6c83ed9a0a31fe9ea08 ac44b4a3d6137489f8fa2e794b12e849c6b22eaa git |
Not specified |
| CNA |
Linux |
Linux |
affected 8910075d61a37e5b0d82e6c83ed9a0a31fe9ea08 90843d00dbc61220b66408ea0d8775cae9e51f70 git |
Not specified |
| CNA |
Linux |
Linux |
affected 8910075d61a37e5b0d82e6c83ed9a0a31fe9ea08 046f6244da9b68e463a849b21446b9424e531491 git |
Not specified |
| CNA |
Linux |
Linux |
affected 8910075d61a37e5b0d82e6c83ed9a0a31fe9ea08 2e706be56f418718bb3ae66c0aa94f9b61150e6d git |
Not specified |
| CNA |
Linux |
Linux |
affected 8910075d61a37e5b0d82e6c83ed9a0a31fe9ea08 47915e855fb38b42133e31ba917d99565f862154 git |
Not specified |
| CNA |
Linux |
Linux |
affected 5.19 |
Not specified |
| CNA |
Linux |
Linux |
unaffected 5.19 semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.6.145 6.6.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.12.97 6.12.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.18.40 6.18.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 7.1.5 7.1.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 7.2-rc3 * original_commit_for_fix |
Not specified |
References
| Reference | Source | Link | Tags |
|---|
| git.kernel.org/stable/c/2e706be56f418718bb3ae66c0aa94f9b61150e6d |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/47915e855fb38b42133e31ba917d99565f862154 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/90843d00dbc61220b66408ea0d8775cae9e51f70 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/ac44b4a3d6137489f8fa2e794b12e849c6b22eaa |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/046f6244da9b68e463a849b21446b9424e531491 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.