SB2026102992 - Insufficient Control Flow Management in Linux kernel events

Description

This security bulletin contains information about 1 vulnerability.

1) Insufficient Control Flow Management (CVE-ID: CVE-2026-99187)

CWE-ID: CWE-691 - Insufficient Control Flow Management

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially disrupt performance monitoring during CPU hotplug.

The vulnerability exists due to incorrect red-black tree traversal in __perf_pmu_remove() in kernel/events/core.c when removing performance event groups during PMU context migration. A local user can exercise affected performance event groups during CPU hotplug to potentially disrupt performance monitoring: removing a group leader prematurely terminates the traversal, leaving other groups running on the source CPU while the PMU interrupt and migrated events reside on another CPU.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/3eb08f09bfb364051f51316da873c3bd51a839ef
• https://git.kernel.org/stable/c/e76b36b4be7160eaa14b416681e548b125702395
• https://git.kernel.org/stable/c/f5f0028764de322a3d04eda0d3b6389ca9847446