CVE-2026-93275

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-93275", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-17T16:02:15.098Z", "datePublished": "2026-09-24T15:52:17.064Z", "dateUpdated": "2026-10-19T09:08:29.668Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:08:29.668Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/x86/intel/pt: Fix stop/start with no update\n\nIf pt_event_stop() is called without PERF_EF_UPDATE flag, then\nperf_aux_output_end() is not called. A subsequent call to pt_event_start()\nwill call perf_aux_output_begin() again which violates the rule against\nnesting and triggers a WARNING in perf_aux_output_begin().\n\nOriginally, pt_event_stop() was never called without PERF_EF_UPDATE,\nbecause the only code paths to do so are from event overflow, and Intel PT\ndoes not do that.\n\nHowever the introduction of group throttling by commit 9734e25fbf5ae\n(\"perf: Fix the throttle logic for a group\") meant that an Intel PT event\ncould be throttled if it was part of a group. Throttling calls PMU\n ->stop() / ->start() callbacks without flags.\n\nAn example is when AUX area sampling is used. The following commands\nhit the issue:\n\n echo 10000 > /proc/sys/kernel/perf_event_max_sample_rate\n\n perf record -F32000 --aux-sample -e '{intel_pt//u,cycles:u}' \\\n -- bash -c 'for i in `seq 1 100000` ; do true ; done'\n\nUse PERF_HES_UPTODATE to track whether perf_aux_output_begin() and\nperf_aux_output_end() are balanced. A cleared PERF_HES_UPTODATE bit\nindicates that an AUX output context is still open.\n\nAmend pt_event_start() / pt_event_stop() accordingly so that begin/end\nstay balanced:\n\n - In non-snapshot mode, stop() always closes the buffer (the buffer may\n have run out of space, and that accounting is done by the update), so\n a following start() opens a fresh one as before.\n\n - In snapshot/overwrite mode, stop() without PERF_EF_UPDATE leaves the\n buffer open so that pt_event_snapshot_aux() can still copy from it,\n and start() then only re-enables tracing instead of calling\n perf_aux_output_begin() again.\n\nNote that pt_event_del() calls pt_event_stop() with PERF_EF_UPDATE flag set\n(as is required by the documentation), so a final call to\nperf_aux_output_end() is assured."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/x86/events/intel/pt.c"], "versions": [{"version": "9734e25fbf5ae68eb04234b2cd14a4b36ab89141", "lessThan": "cab5015ee3f25f789b4a368f2abfa65536576b78", "status": "affected", "versionType": "git"}, {"version": "9734e25fbf5ae68eb04234b2cd14a4b36ab89141", "lessThan": "304844b5545f444d523286da8228a1cbc46ffffa", "status": "affected", "versionType": "git"}, {"version": "9734e25fbf5ae68eb04234b2cd14a4b36ab89141", "lessThan": "2e17bf3a469a41457a3bc31b1f8fd66b6ce94a6d", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/x86/events/intel/pt.c"], "versions": [{"version": "6.16", "status": "affected"}, {"version": "0", "lessThan": "6.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.52", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.6", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.18.52"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.2.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/cab5015ee3f25f789b4a368f2abfa65536576b78"}, {"url": "https://git.kernel.org/stable/c/304844b5545f444d523286da8228a1cbc46ffffa"}, {"url": "https://git.kernel.org/stable/c/2e17bf3a469a41457a3bc31b1f8fd66b6ce94a6d"}], "title": "perf/x86/intel/pt: Fix stop/start with no update", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["arch/x86/events/intel/pt.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "cab5015ee3f25f789b4a368f2abfa65536576b78", "status": "affected", "version": "9734e25fbf5ae68eb04234b2cd14a4b36ab89141", "versionType": "git"}, {"lessThan": "304844b5545f444d523286da8228a1cbc46ffffa", "status": "affected", "version": "9734e25fbf5ae68eb04234b2cd14a4b36ab89141", "versionType": "git"}, {"lessThan": "2e17bf3a469a41457a3bc31b1f8fd66b6ce94a6d", "status": "affected", "version": "9734e25fbf5ae68eb04234b2cd14a4b36ab89141", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["arch/x86/events/intel/pt.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.16"}, {"lessThan": "6.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.52", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/x86/intel/pt: Fix stop/start with no update\n\nIf pt_event_stop() is called without PERF_EF_UPDATE flag, then\nperf_aux_output_end() is not called. A subsequent call to pt_event_start()\nwill call perf_aux_output_begin() again which violates the rule against\nnesting and triggers a WARNING in perf_aux_output_begin().\n\nOriginally, pt_event_stop() was never called without PERF_EF_UPDATE,\nbecause the only code paths to do so are from event overflow, and Intel PT\ndoes not do that.\n\nHowever the introduction of group throttling by commit 9734e25fbf5ae\n(\"perf: Fix the throttle logic for a group\") meant that an Intel PT event\ncould be throttled if it was part of a group. Throttling calls PMU\n ->stop() / ->start() callbacks without flags.\n\nAn example is when AUX area sampling is used. The following commands\nhit the issue:\n\n echo 10000 > /proc/sys/kernel/perf_event_max_sample_rate\n\n perf record -F32000 --aux-sample -e '{intel_pt//u,cycles:u}' \\\n -- bash -c 'for i in `seq 1 100000` ; do true ; done'\n\nUse PERF_HES_UPTODATE to track whether perf_aux_output_begin() and\nperf_aux_output_end() are balanced. A cleared PERF_HES_UPTODATE bit\nindicates that an AUX output context is still open.\n\nAmend pt_event_start() / pt_event_stop() accordingly so that begin/end\nstay balanced:\n\n - In non-snapshot mode, stop() always closes the buffer (the buffer may\n have run out of space, and that accounting is done by the update), so\n a following start() opens a fresh one as before.\n\n - In snapshot/overwrite mode, stop() without PERF_EF_UPDATE leaves the\n buffer open so that pt_event_snapshot_aux() can still copy from it,\n and start() then only re-enables tracing instead of calling\n perf_aux_output_begin() again.\n\nNote that pt_event_del() calls pt_event_stop() with PERF_EF_UPDATE flag set\n(as is required by the documentation), so a final call to\nperf_aux_output_end() is assured."}], "id": "CVE-2026-93275", "lastModified": "2026-10-19T10:17:19.020", "metrics": {}, "published": "2026-09-24T16:17:24.667", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2e17bf3a469a41457a3bc31b1f8fd66b6ce94a6d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/304844b5545f444d523286da8228a1cbc46ffffa"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cab5015ee3f25f789b4a368f2abfa65536576b78"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: perf/x86/intel/pt: Fix stop/start with no update", "id": "2540349", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2540349"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-617", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nperf/x86/intel/pt: Fix stop/start with no update\nIf pt_event_stop() is called without PERF_EF_UPDATE flag, then\nperf_aux_output_end() is not called. A subsequent call to pt_event_start()\nwill call perf_aux_output_begin() again which violates the rule against\nnesting and triggers a WARNING in perf_aux_output_begin().\nOriginally, pt_event_stop() was never called without PERF_EF_UPDATE,\nbecause the only code paths to do so are from event overflow, and Intel PT\ndoes not do that.\nHowever the introduction of group throttling by commit 9734e25fbf5ae\n(\"perf: Fix the throttle logic for a group\") meant that an Intel PT event\ncould be throttled if it was part of a group. Throttling calls PMU\n->stop() / ->start() callbacks without flags.\nAn example is when AUX area sampling is used. The following commands\nhit the issue:\necho 10000 > /proc/sys/kernel/perf_event_max_sample_rate\nperf record -F32000 --aux-sample -e '{intel_pt//u,cycles:u}' \\\n-- bash -c 'for i in `seq 1 100000` ; do true ; done'\nUse PERF_HES_UPTODATE to track whether perf_aux_output_begin() and\nperf_aux_output_end() are balanced. A cleared PERF_HES_UPTODATE bit\nindicates that an AUX output context is still open.\nAmend pt_event_start() / pt_event_stop() accordingly so that begin/end\nstay balanced:\n- In non-snapshot mode, stop() always closes the buffer (the buffer may\nhave run out of space, and that accounting is done by the update), so\na following start() opens a fresh one as before.\n- In snapshot/overwrite mode, stop() without PERF_EF_UPDATE leaves the\nbuffer open so that pt_event_snapshot_aux() can still copy from it,\nand start() then only re-enables tracing instead of calling\nperf_aux_output_begin() again.\nNote that pt_event_del() calls pt_event_stop() with PERF_EF_UPDATE flag set\n(as is required by the documentation), so a final call to\nperf_aux_output_end() is assured.", "A flaw was found in the Linux kernel's Intel Processor Trace (PT) subsystem. A local user could trigger a Denial of Service (DoS) condition by executing performance monitoring operations that cause group event throttling. Due to improper state tracking during event start and stop operations, the auxiliary trace buffer fails to balance open and close requests, leading to internal kernel warnings and potential system instability."], "name": "CVE-2026-93275", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-93275\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-93275\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-93275.mbox"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[52ca9ced3f70779589e6ecc329baffe69d8f5f7a,9b919fb5512f256e9e0604faf960b2bb98aab454)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[52ca9ced3f70779589e6ecc329baffe69d8f5f7a,cab5015ee3f25f789b4a368f2abfa65536576b78)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[52ca9ced3f70779589e6ecc329baffe69d8f5f7a,304844b5545f444d523286da8228a1cbc46ffffa)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[52ca9ced3f70779589e6ecc329baffe69d8f5f7a,2e17bf3a469a41457a3bc31b1f8fd66b6ce94a6d)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.1"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.1)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.110,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.52,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2.6,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc1,*)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T05:00:09.768400+00:00", "updated": "2026-10-01T20:15:12.385456+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}