Insufficient Control Flow Management in Linux kernel - CVE-2026-99187
Published: October 29, 2026
Vulnerability identifier: #VU158397
CSH Severity: Low
CVSS v4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-99187
CWE-ID: CWE-691
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to potentially disrupt performance monitoring during CPU hotplug.
The vulnerability exists due to incorrect red-black tree traversal in __perf_pmu_remove() in kernel/events/core.c when removing performance event groups during PMU context migration. A local user can exercise affected performance event groups during CPU hotplug to potentially disrupt performance monitoring: removing a group leader prematurely terminates the traversal, leaving other groups running on the source CPU while the PMU interrupt and migrated events reside on another CPU.
Affected software
Linux kernel
Debian Linux
linux (Debian package)
Debian Linux
linux (Debian package)
How to mitigate CVE-2026-99187
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux (Debian package) - update to 6.12.115-2
linux (Debian package) - update to 6.12.115-2