SB20260816295 - Observable discrepancy in Linux kernel s390 kernel
Published: August 16, 2026
Security Bulletin ID
SB20260816295
CSH Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Observable discrepancy (CVE-ID: CVE-2026-72236)
CWE-ID: CWE-203 - Observable discrepancy
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to improper restriction of speculative execution in __hw_perf_event_init() in arch/s390/kernel/perf_cpum_cf.c when processing a user-controlled perf event configuration value as an array index. A local user can supply a crafted event->attr.config value to disclose sensitive information.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/27206bb57c47bdbe33bccc78fa7f7e2a719a06b9
- https://git.kernel.org/stable/c/49145bce539117db4b6e9e83c0e5ef528e361050
- https://git.kernel.org/stable/c/a21f3615c88421df81060b6ff89220fd34094c4d
- https://git.kernel.org/stable/c/f79dff8c721bbb1f3fc312ea55e0551c2cc28801
- https://git.kernel.org/stable/c/fa1ebae4206e6afc8caa642e9eb1bbe39a9a724f