perf/x86/intel: Fix kernel address leakages in LBR stack

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-89984
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-09-16 11:17:09 UTC
Updated2026-09-16 11:17:09 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Fix kernel address leakages in LBR stack Before Arch LBR gained CPL filtering support, a user-only branch stack could still contain kernel addresses. As a result, kernel branch records may be exposed to user space even when PERF_SAMPLE_BRANCH_USER is requested. For example, on Intel Tiger Lake, the following command can still report SYSRET/ERET entries with kernel-space from addresses: $ ./perf record -e cycles:p -o - --branch-filter any,save_type,u -- \ ./perf bench syscall basic --loop 1000 | \ ./perf script -i - --fields brstack|tr ' ' '\n'| \ grep -E '0x[89a-f][0-9a-f]{15}' Total time: 0.000 [sec] 0.219000 usecs/op 4,566,210 ops/sec [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.551 MB - ] 0xffffffff93c001c8/0x7f12a2b1d647/P/-/-/16959/SYSRET/- 0xffffffff93c001c8/0x7f12a2b1d5c2/P/-/-/17535/SYSRET/- 0xffffffff93c01928/0x7f12a2861000/P/-/-/6719/ERET/- 0xffffffff93c01928/0x7f12a297a000/P/-/-/8575/ERET/- The problem is that intel_pmu_lbr_filter() does not fully validate the privilege level of sampled entries. It filters some mismatches based on the branch type and the to address, but it does not reject entries whose from address violates the requested branch privilege filter. Fix this by extending software filtering to validate both from and to addresses against br_sel. Any LBR entry contains kernel address does not match the requested user filter is dropped. This prevents kernel addresses from appearing in user-only branch stacks.

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 47125db27e47e9d44c878bf8925aa057824bb0d5 f3705db4e6378cc1b91a38ce0fe2f879055e23ca git Not specified
CNA Linux Linux affected 47125db27e47e9d44c878bf8925aa057824bb0d5 b589147f54adc62e4172e4acf079ad5fb7b3687f git Not specified
CNA Linux Linux affected 47125db27e47e9d44c878bf8925aa057824bb0d5 be0628a101ac05b085aaa4f650d48bd3915e80fa git Not specified
CNA Linux Linux affected 47125db27e47e9d44c878bf8925aa057824bb0d5 ca19a175e89b7de604fab736436cbab74030b47a git Not specified
CNA Linux Linux affected 47125db27e47e9d44c878bf8925aa057824bb0d5 6ac26161db27f7fb9d9e89ae240dbe52795496cc git Not specified
CNA Linux Linux affected 47125db27e47e9d44c878bf8925aa057824bb0d5 3c492c8eba02698ca893a9a13388d2adf6dfb839 git Not specified
CNA Linux Linux affected 47125db27e47e9d44c878bf8925aa057824bb0d5 68c4b780b266a435261a1e029bede5ee3c2735cc git Not specified
CNA Linux Linux affected 47125db27e47e9d44c878bf8925aa057824bb0d5 e2b0575900ff72aa82748af96e7bd564ade5157a git Not specified
CNA Linux Linux affected 5.9 Not specified
CNA Linux Linux unaffected 5.9 semver Not specified
CNA Linux Linux unaffected 5.10.270 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.221 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.188 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.157 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.110 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.51 6.18.* semver Not specified
CNA Linux Linux unaffected 7.2.5 7.2.* semver Not specified
CNA Linux Linux unaffected 7.3-rc1 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/6ac26161db27f7fb9d9e89ae240dbe52795496cc 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/3c492c8eba02698ca893a9a13388d2adf6dfb839 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/68c4b780b266a435261a1e029bede5ee3c2735cc 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/b589147f54adc62e4172e4acf079ad5fb7b3687f 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/ca19a175e89b7de604fab736436cbab74030b47a 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/be0628a101ac05b085aaa4f650d48bd3915e80fa 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/f3705db4e6378cc1b91a38ce0fe2f879055e23ca 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/e2b0575900ff72aa82748af96e7bd564ade5157a 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report