CVE-2026-72325

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72325", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-09T03:40:39.919Z", "datePublished": "2026-08-15T05:55:36.148Z", "dateUpdated": "2026-10-30T12:29:03.961Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:29:03.961Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/x86/amd/core: Avoid enabling BRS from the SVM reload path\n\nBranch Sampling (BRS) and Last Branch Record (LBR) are mutually\nexclusive hardware features, and users of both are tracked via\ncpuc->lbr_users.\n\nWhen SVM is toggled on a CPU, the host perf events are reprogrammed to\nupdate the HostOnly filter bit (set when virtualization is enabled,\ncleared when it is disabled). On PerfMonV2-capable processors, this\nreprogramming is performed by calling amd_pmu_enable_all() to rewrite\nthe event selectors. However, amd_pmu_enable_all() also calls\namd_brs_enable_all(), which enables BRS whenever cpuc->lbr_users > 0.\nHaving active LBR events satisfies this gating on processors that have\nLBR but not BRS. The kernel then tries to set the BRS enable bit in\nDebugExtnCfg (MSR 0xc000010f). Since that bit is deprecated on such\nhardware, the write results in a #GP:\n\n Call Trace:\n <IRQ>\n amd_pmu_enable_all+0x1d/0x90\n amd_pmu_disable_virt+0x62/0xb0\n kvm_arch_disable_virtualization_cpu+0xa/0x40 [kvm]\n hardware_disable_nolock+0x1a/0x30 [kvm]\n __flush_smp_call_function_queue+0x9b/0x410\n __sysvec_call_function+0x18/0xc0\n sysvec_call_function+0x69/0x90\n </IRQ>\n <TASK>\n asm_sysvec_call_function+0x16/0x20\n RIP: 0010:cpuidle_enter_state+0xc4/0x450\n ? cpuidle_enter_state+0xb7/0x450\n cpuidle_enter+0x29/0x40\n cpuidle_idle_call+0xf5/0x160\n do_idle+0x7b/0xe0\n cpu_startup_entry+0x26/0x30\n start_secondary+0x115/0x140\n secondary_startup_64_no_verify+0x194/0x19b\n </TASK>\n\nFix this by ensuring that BRS is not enabled from the event selector\nreprogramming path even when cpuc->lbr_users > 0."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/x86/events/amd/core.c"], "versions": [{"version": "bae19fdd7e9e759580ac4693d2df3bc23ab415d7", "lessThan": "cb5322d04694d153cd5418267f8765a44b935f82", "status": "affected", "versionType": "git"}, {"version": "bae19fdd7e9e759580ac4693d2df3bc23ab415d7", "lessThan": "3b0aa139ba09a5b73c0f300e652076232f869f68", "status": "affected", "versionType": "git"}, {"version": "bae19fdd7e9e759580ac4693d2df3bc23ab415d7", "lessThan": "e9b1a7411a667539c2f55e720bbb5f623b526a32", "status": "affected", "versionType": "git"}, {"version": "bae19fdd7e9e759580ac4693d2df3bc23ab415d7", "lessThan": "7cc438c99bba324a0562b1bafa747b10f7e251df", "status": "affected", "versionType": "git"}, {"version": "bae19fdd7e9e759580ac4693d2df3bc23ab415d7", "lessThan": "46d0fd8535edce31f15e48d2de1bdee39a4850e5", "status": "affected", "versionType": "git"}, {"version": "bae19fdd7e9e759580ac4693d2df3bc23ab415d7", "lessThan": "07c60dda9c059c09f83d42a3ebda2e7cc1cf3bc2", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/x86/events/amd/core.c"], "versions": [{"version": "5.19", "status": "affected"}, {"version": "0", "lessThan": "5.19", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.97", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.12.97"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/cb5322d04694d153cd5418267f8765a44b935f82"}, {"url": "https://git.kernel.org/stable/c/3b0aa139ba09a5b73c0f300e652076232f869f68"}, {"url": "https://git.kernel.org/stable/c/e9b1a7411a667539c2f55e720bbb5f623b526a32"}, {"url": "https://git.kernel.org/stable/c/7cc438c99bba324a0562b1bafa747b10f7e251df"}, {"url": "https://git.kernel.org/stable/c/46d0fd8535edce31f15e48d2de1bdee39a4850e5"}, {"url": "https://git.kernel.org/stable/c/07c60dda9c059c09f83d42a3ebda2e7cc1cf3bc2"}], "title": "perf/x86/amd/core: Avoid enabling BRS from the SVM reload path", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["arch/x86/events/amd/core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "cb5322d04694d153cd5418267f8765a44b935f82", "status": "affected", "version": "bae19fdd7e9e759580ac4693d2df3bc23ab415d7", "versionType": "git"}, {"lessThan": "3b0aa139ba09a5b73c0f300e652076232f869f68", "status": "affected", "version": "bae19fdd7e9e759580ac4693d2df3bc23ab415d7", "versionType": "git"}, {"lessThan": "e9b1a7411a667539c2f55e720bbb5f623b526a32", "status": "affected", "version": "bae19fdd7e9e759580ac4693d2df3bc23ab415d7", "versionType": "git"}, {"lessThan": "7cc438c99bba324a0562b1bafa747b10f7e251df", "status": "affected", "version": "bae19fdd7e9e759580ac4693d2df3bc23ab415d7", "versionType": "git"}, {"lessThan": "46d0fd8535edce31f15e48d2de1bdee39a4850e5", "status": "affected", "version": "bae19fdd7e9e759580ac4693d2df3bc23ab415d7", "versionType": "git"}, {"lessThan": "07c60dda9c059c09f83d42a3ebda2e7cc1cf3bc2", "status": "affected", "version": "bae19fdd7e9e759580ac4693d2df3bc23ab415d7", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["arch/x86/events/amd/core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.19"}, {"lessThan": "5.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.97", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/x86/amd/core: Avoid enabling BRS from the SVM reload path\n\nBranch Sampling (BRS) and Last Branch Record (LBR) are mutually\nexclusive hardware features, and users of both are tracked via\ncpuc->lbr_users.\n\nWhen SVM is toggled on a CPU, the host perf events are reprogrammed to\nupdate the HostOnly filter bit (set when virtualization is enabled,\ncleared when it is disabled). On PerfMonV2-capable processors, this\nreprogramming is performed by calling amd_pmu_enable_all() to rewrite\nthe event selectors. However, amd_pmu_enable_all() also calls\namd_brs_enable_all(), which enables BRS whenever cpuc->lbr_users > 0.\nHaving active LBR events satisfies this gating on processors that have\nLBR but not BRS. The kernel then tries to set the BRS enable bit in\nDebugExtnCfg (MSR 0xc000010f). Since that bit is deprecated on such\nhardware, the write results in a #GP:\n\n Call Trace:\n <IRQ>\n amd_pmu_enable_all+0x1d/0x90\n amd_pmu_disable_virt+0x62/0xb0\n kvm_arch_disable_virtualization_cpu+0xa/0x40 [kvm]\n hardware_disable_nolock+0x1a/0x30 [kvm]\n __flush_smp_call_function_queue+0x9b/0x410\n __sysvec_call_function+0x18/0xc0\n sysvec_call_function+0x69/0x90\n </IRQ>\n <TASK>\n asm_sysvec_call_function+0x16/0x20\n RIP: 0010:cpuidle_enter_state+0xc4/0x450\n ? cpuidle_enter_state+0xb7/0x450\n cpuidle_enter+0x29/0x40\n cpuidle_idle_call+0xf5/0x160\n do_idle+0x7b/0xe0\n cpu_startup_entry+0x26/0x30\n start_secondary+0x115/0x140\n secondary_startup_64_no_verify+0x194/0x19b\n </TASK>\n\nFix this by ensuring that BRS is not enabled from the event selector\nreprogramming path even when cpuc->lbr_users > 0."}], "id": "CVE-2026-72325", "lastModified": "2026-10-30T13:19:49.343", "metrics": {}, "published": "2026-08-15T06:22:05.547", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/07c60dda9c059c09f83d42a3ebda2e7cc1cf3bc2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3b0aa139ba09a5b73c0f300e652076232f869f68"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/46d0fd8535edce31f15e48d2de1bdee39a4850e5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7cc438c99bba324a0562b1bafa747b10f7e251df"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cb5322d04694d153cd5418267f8765a44b935f82"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e9b1a7411a667539c2f55e720bbb5f623b526a32"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: perf/x86/amd/core: Avoid enabling BRS from the SVM reload path", "id": "2516742", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516742"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-358", "details": ["A flaw was found in the Linux kernel's performance monitoring unit (PMU) for AMD processors. When Secure Virtual Machine (SVM) is toggled on a CPU with active Last Branch Record (LBR) events, the system incorrectly attempts to enable Branch Sampling (BRS) on hardware that does not support it. This misconfiguration leads to a General Protection Fault, which can cause the system to crash, resulting in a Denial of Service (DoS)."], "name": "CVE-2026-72325", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-72325\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-72325\nhttps://lore.kernel.org/linux-cve-announce/2026081507-CVE-2026-72325-db28@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bae19fdd7e9e759580ac4693d2df3bc23ab415d7,e9b1a7411a667539c2f55e720bbb5f623b526a32)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bae19fdd7e9e759580ac4693d2df3bc23ab415d7,7cc438c99bba324a0562b1bafa747b10f7e251df)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bae19fdd7e9e759580ac4693d2df3bc23ab415d7,46d0fd8535edce31f15e48d2de1bdee39a4850e5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bae19fdd7e9e759580ac4693d2df3bc23ab415d7,07c60dda9c059c09f83d42a3ebda2e7cc1cf3bc2)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.97,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.40,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T10:30:05.217254+00:00", "updated": "2026-08-22T09:30:17.175117+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}