{"api_version":"1","generated_at":"2026-08-22T21:11:56+00:00","cve":"CVE-2026-72325","urls":{"html":"https://cve.report/CVE-2026-72325","api":"https://cve.report/api/cve/CVE-2026-72325.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-72325","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-72325"},"summary":{"title":"perf/x86/amd/core: Avoid enabling BRS from the SVM reload path","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nperf/x86/amd/core: Avoid enabling BRS from the SVM reload path\n\nBranch Sampling (BRS) and Last Branch Record (LBR) are mutually\nexclusive hardware features, and users of both are tracked via\ncpuc->lbr_users.\n\nWhen SVM is toggled on a CPU, the host perf events are reprogrammed to\nupdate the HostOnly filter bit (set when virtualization is enabled,\ncleared when it is disabled). On PerfMonV2-capable processors, this\nreprogramming is performed by calling amd_pmu_enable_all() to rewrite\nthe event selectors. However, amd_pmu_enable_all() also calls\namd_brs_enable_all(), which enables BRS whenever cpuc->lbr_users > 0.\nHaving active LBR events satisfies this gating on processors that have\nLBR but not BRS. The kernel then tries to set the BRS enable bit in\nDebugExtnCfg (MSR 0xc000010f). Since that bit is deprecated on such\nhardware, the write results in a #GP:\n\n  Call Trace:\n   <IRQ>\n   amd_pmu_enable_all+0x1d/0x90\n   amd_pmu_disable_virt+0x62/0xb0\n   kvm_arch_disable_virtualization_cpu+0xa/0x40 [kvm]\n   hardware_disable_nolock+0x1a/0x30 [kvm]\n   __flush_smp_call_function_queue+0x9b/0x410\n   __sysvec_call_function+0x18/0xc0\n   sysvec_call_function+0x69/0x90\n   </IRQ>\n   <TASK>\n   asm_sysvec_call_function+0x16/0x20\n  RIP: 0010:cpuidle_enter_state+0xc4/0x450\n   ? cpuidle_enter_state+0xb7/0x450\n   cpuidle_enter+0x29/0x40\n   cpuidle_idle_call+0xf5/0x160\n   do_idle+0x7b/0xe0\n   cpu_startup_entry+0x26/0x30\n   start_secondary+0x115/0x140\n   secondary_startup_64_no_verify+0x194/0x19b\n   </TASK>\n\nFix this by ensuring that BRS is not enabled from the event selector\nreprogramming path even when cpuc->lbr_users > 0.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-08-15 06:22:05","updated_at":"2026-08-17 06:18:36"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/07c60dda9c059c09f83d42a3ebda2e7cc1cf3bc2","name":"https://git.kernel.org/stable/c/07c60dda9c059c09f83d42a3ebda2e7cc1cf3bc2","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/46d0fd8535edce31f15e48d2de1bdee39a4850e5","name":"https://git.kernel.org/stable/c/46d0fd8535edce31f15e48d2de1bdee39a4850e5","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/e9b1a7411a667539c2f55e720bbb5f623b526a32","name":"https://git.kernel.org/stable/c/e9b1a7411a667539c2f55e720bbb5f623b526a32","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/7cc438c99bba324a0562b1bafa747b10f7e251df","name":"https://git.kernel.org/stable/c/7cc438c99bba324a0562b1bafa747b10f7e251df","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-72325","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72325","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected bae19fdd7e9e759580ac4693d2df3bc23ab415d7 e9b1a7411a667539c2f55e720bbb5f623b526a32 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected bae19fdd7e9e759580ac4693d2df3bc23ab415d7 7cc438c99bba324a0562b1bafa747b10f7e251df git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected bae19fdd7e9e759580ac4693d2df3bc23ab415d7 46d0fd8535edce31f15e48d2de1bdee39a4850e5 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected bae19fdd7e9e759580ac4693d2df3bc23ab415d7 07c60dda9c059c09f83d42a3ebda2e7cc1cf3bc2 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.19","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.19 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.97 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.40 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1.5 7.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"72325","cve":"CVE-2026-72325","epss":"0.002090000","percentile":"0.113510000","score_date":"2026-08-17","updated_at":"2026-08-18 00:11:47"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/x86/events/amd/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"e9b1a7411a667539c2f55e720bbb5f623b526a32","status":"affected","version":"bae19fdd7e9e759580ac4693d2df3bc23ab415d7","versionType":"git"},{"lessThan":"7cc438c99bba324a0562b1bafa747b10f7e251df","status":"affected","version":"bae19fdd7e9e759580ac4693d2df3bc23ab415d7","versionType":"git"},{"lessThan":"46d0fd8535edce31f15e48d2de1bdee39a4850e5","status":"affected","version":"bae19fdd7e9e759580ac4693d2df3bc23ab415d7","versionType":"git"},{"lessThan":"07c60dda9c059c09f83d42a3ebda2e7cc1cf3bc2","status":"affected","version":"bae19fdd7e9e759580ac4693d2df3bc23ab415d7","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/x86/events/amd/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.19"},{"lessThan":"5.19","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.97","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.40","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.97","versionStartIncluding":"5.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.40","versionStartIncluding":"5.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.5","versionStartIncluding":"5.19","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2","versionStartIncluding":"5.19","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nperf/x86/amd/core: Avoid enabling BRS from the SVM reload path\n\nBranch Sampling (BRS) and Last Branch Record (LBR) are mutually\nexclusive hardware features, and users of both are tracked via\ncpuc->lbr_users.\n\nWhen SVM is toggled on a CPU, the host perf events are reprogrammed to\nupdate the HostOnly filter bit (set when virtualization is enabled,\ncleared when it is disabled). On PerfMonV2-capable processors, this\nreprogramming is performed by calling amd_pmu_enable_all() to rewrite\nthe event selectors. However, amd_pmu_enable_all() also calls\namd_brs_enable_all(), which enables BRS whenever cpuc->lbr_users > 0.\nHaving active LBR events satisfies this gating on processors that have\nLBR but not BRS. The kernel then tries to set the BRS enable bit in\nDebugExtnCfg (MSR 0xc000010f). Since that bit is deprecated on such\nhardware, the write results in a #GP:\n\n  Call Trace:\n   <IRQ>\n   amd_pmu_enable_all+0x1d/0x90\n   amd_pmu_disable_virt+0x62/0xb0\n   kvm_arch_disable_virtualization_cpu+0xa/0x40 [kvm]\n   hardware_disable_nolock+0x1a/0x30 [kvm]\n   __flush_smp_call_function_queue+0x9b/0x410\n   __sysvec_call_function+0x18/0xc0\n   sysvec_call_function+0x69/0x90\n   </IRQ>\n   <TASK>\n   asm_sysvec_call_function+0x16/0x20\n  RIP: 0010:cpuidle_enter_state+0xc4/0x450\n   ? cpuidle_enter_state+0xb7/0x450\n   cpuidle_enter+0x29/0x40\n   cpuidle_idle_call+0xf5/0x160\n   do_idle+0x7b/0xe0\n   cpu_startup_entry+0x26/0x30\n   start_secondary+0x115/0x140\n   secondary_startup_64_no_verify+0x194/0x19b\n   </TASK>\n\nFix this by ensuring that BRS is not enabled from the event selector\nreprogramming path even when cpuc->lbr_users > 0."}],"providerMetadata":{"dateUpdated":"2026-08-17T05:12:31.697Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/e9b1a7411a667539c2f55e720bbb5f623b526a32"},{"url":"https://git.kernel.org/stable/c/7cc438c99bba324a0562b1bafa747b10f7e251df"},{"url":"https://git.kernel.org/stable/c/46d0fd8535edce31f15e48d2de1bdee39a4850e5"},{"url":"https://git.kernel.org/stable/c/07c60dda9c059c09f83d42a3ebda2e7cc1cf3bc2"}],"title":"perf/x86/amd/core: Avoid enabling BRS from the SVM reload path","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-72325","datePublished":"2026-08-15T05:55:36.148Z","dateReserved":"2026-08-09T03:40:39.919Z","dateUpdated":"2026-08-17T05:12:31.697Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-15 06:22:05","lastModifiedDate":"2026-08-17 06:18:36","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"72325","Ordinal":"1","Title":"perf/x86/amd/core: Avoid enabling BRS from the SVM reload path","CVE":"CVE-2026-72325","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"72325","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nperf/x86/amd/core: Avoid enabling BRS from the SVM reload path\n\nBranch Sampling (BRS) and Last Branch Record (LBR) are mutually\nexclusive hardware features, and users of both are tracked via\ncpuc->lbr_users.\n\nWhen SVM is toggled on a CPU, the host perf events are reprogrammed to\nupdate the HostOnly filter bit (set when virtualization is enabled,\ncleared when it is disabled). On PerfMonV2-capable processors, this\nreprogramming is performed by calling amd_pmu_enable_all() to rewrite\nthe event selectors. However, amd_pmu_enable_all() also calls\namd_brs_enable_all(), which enables BRS whenever cpuc->lbr_users > 0.\nHaving active LBR events satisfies this gating on processors that have\nLBR but not BRS. The kernel then tries to set the BRS enable bit in\nDebugExtnCfg (MSR 0xc000010f). Since that bit is deprecated on such\nhardware, the write results in a #GP:\n\n  Call Trace:\n   <IRQ>\n   amd_pmu_enable_all+0x1d/0x90\n   amd_pmu_disable_virt+0x62/0xb0\n   kvm_arch_disable_virtualization_cpu+0xa/0x40 [kvm]\n   hardware_disable_nolock+0x1a/0x30 [kvm]\n   __flush_smp_call_function_queue+0x9b/0x410\n   __sysvec_call_function+0x18/0xc0\n   sysvec_call_function+0x69/0x90\n   </IRQ>\n   <TASK>\n   asm_sysvec_call_function+0x16/0x20\n  RIP: 0010:cpuidle_enter_state+0xc4/0x450\n   ? cpuidle_enter_state+0xb7/0x450\n   cpuidle_enter+0x29/0x40\n   cpuidle_idle_call+0xf5/0x160\n   do_idle+0x7b/0xe0\n   cpu_startup_entry+0x26/0x30\n   start_secondary+0x115/0x140\n   secondary_startup_64_no_verify+0x194/0x19b\n   </TASK>\n\nFix this by ensuring that BRS is not enabled from the event selector\nreprogramming path even when cpuc->lbr_users > 0.","Type":"Description","Title":"perf/x86/amd/core: Avoid enabling BRS from the SVM reload path"}]}}}