SB20260928353 - Out-of-bounds read in Linux kernel linux perf

Description

This security bulletin contains information about 1 vulnerability.

1) Out-of-bounds read (CVE-ID: CVE-2026-97587)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to an out-of-bounds read in the RISC-V performance monitoring unit counter mask handling when processing available counter masks on RV32 systems. A local user can trigger performance counter handling that iterates beyond the single unsigned long counter mask to disclose sensitive information.

On RV32 systems, the counter iteration limit is 64 while an unsigned long counter mask has only 32 bits.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/143668c424772979a45118dc9cc9c2c13a35f41d
• https://git.kernel.org/stable/c/6809da6e9c08ccc9a09cb0a48c61471679274aaa
• https://git.kernel.org/stable/c/9bec7beaed074bcae4181fde9ff9dfbe4e7b0957
• https://git.kernel.org/stable/c/e5481db31f4654e9a1254d5d467d9b1ff2f8b1cb