CVE-2026-99125

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99125", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.393Z", "datePublished": "2026-10-28T10:34:40.025Z", "dateUpdated": "2026-10-28T10:34:40.025Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-28T10:34:40.025Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/pai: Handle multiple PMU stop callback invocations\n\nHandle the following scenario:\nThe kernel protects itself against a very high sampling load and\nthrottles the sampling using:\n\n perf_event_throttle() --> PMU->stop()\n\nShortly later the scheduler may terminate the task and removes it from the\nCPU. It again calls\n\n PMU->stop()\n\nwhich results in two invocations of PMU->stop() called back to back.\nProtect against this and check the PERF_HES_STOPPED bit on function\nentry. If it is already set return.\nClear bit PERF_HES_STOPPED in PMU->start().\n\nProhibit ioctl(fd, PERF_EVENT_IOC_PERIOD, ...) call for this event.\nIt sets perf_event::event_limit to a positive value and causes\nperf_event_overflow() to invoke pai_stop() call back function when\nperf_event::event_limit hits zero. This is not supported because the\nsample events CRYPTO_ALL and NNPA_ALL are only taken at schedule out\nof a task.\n\nUse list_for_each_entry_safe() for safe iteration over syswide_list\nin pai_have_samples()."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/s390/kernel/perf_pai.c"], "versions": [{"version": "9f66572f2889a5e72a9d7e17787e52f03b1f7bd8", "lessThan": "cf348ec613f75b9774291e47b804fd7010835a6c", "status": "affected", "versionType": "git"}, {"version": "9f66572f2889a5e72a9d7e17787e52f03b1f7bd8", "lessThan": "f3110e969ad226ffbb2d9b4bf5387e68d0d9ef40", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/s390/kernel/perf_pai.c"], "versions": [{"version": "6.11", "status": "affected"}, {"version": "0", "lessThan": "6.11", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.13", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "7.2.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/cf348ec613f75b9774291e47b804fd7010835a6c"}, {"url": "https://git.kernel.org/stable/c/f3110e969ad226ffbb2d9b4bf5387e68d0d9ef40"}], "title": "s390/pai: Handle multiple PMU stop callback invocations", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["arch/s390/kernel/perf_pai.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "cf348ec613f75b9774291e47b804fd7010835a6c", "status": "affected", "version": "9f66572f2889a5e72a9d7e17787e52f03b1f7bd8", "versionType": "git"}, {"lessThan": "f3110e969ad226ffbb2d9b4bf5387e68d0d9ef40", "status": "affected", "version": "9f66572f2889a5e72a9d7e17787e52f03b1f7bd8", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["arch/s390/kernel/perf_pai.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.11"}, {"lessThan": "6.11", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.13", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/pai: Handle multiple PMU stop callback invocations\n\nHandle the following scenario:\nThe kernel protects itself against a very high sampling load and\nthrottles the sampling using:\n\n perf_event_throttle() --> PMU->stop()\n\nShortly later the scheduler may terminate the task and removes it from the\nCPU. It again calls\n\n PMU->stop()\n\nwhich results in two invocations of PMU->stop() called back to back.\nProtect against this and check the PERF_HES_STOPPED bit on function\nentry. If it is already set return.\nClear bit PERF_HES_STOPPED in PMU->start().\n\nProhibit ioctl(fd, PERF_EVENT_IOC_PERIOD, ...) call for this event.\nIt sets perf_event::event_limit to a positive value and causes\nperf_event_overflow() to invoke pai_stop() call back function when\nperf_event::event_limit hits zero. This is not supported because the\nsample events CRYPTO_ALL and NNPA_ALL are only taken at schedule out\nof a task.\n\nUse list_for_each_entry_safe() for safe iteration over syswide_list\nin pai_have_samples()."}], "id": "CVE-2026-99125", "lastModified": "2026-10-28T11:17:32.210", "metrics": {}, "published": "2026-10-28T11:17:32.210", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cf348ec613f75b9774291e47b804fd7010835a6c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f3110e969ad226ffbb2d9b4bf5387e68d0d9ef40"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: Denial of Service via multiple PMU stop callback invocations on s390", "id": "2562754", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2562754"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-1341", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ns390/pai: Handle multiple PMU stop callback invocations\nHandle the following scenario:\nThe kernel protects itself against a very high sampling load and\nthrottles the sampling using:\nperf_event_throttle() --> PMU->stop()\nShortly later the scheduler may terminate the task and removes it from the\nCPU. It again calls\nPMU->stop()\nwhich results in two invocations of PMU->stop() called back to back.\nProtect against this and check the PERF_HES_STOPPED bit on function\nentry. If it is already set return.\nClear bit PERF_HES_STOPPED in PMU->start().\nProhibit ioctl(fd, PERF_EVENT_IOC_PERIOD, ...) call for this event.\nIt sets perf_event::event_limit to a positive value and causes\nperf_event_overflow() to invoke pai_stop() call back function when\nperf_event::event_limit hits zero. This is not supported because the\nsample events CRYPTO_ALL and NNPA_ALL are only taken at schedule out\nof a task.\nUse list_for_each_entry_safe() for safe iteration over syswide_list\nin pai_have_samples().", "A flaw was found in the Linux kernel's s390 Processor Activity Instrumentation (PAI) performance monitoring subsystem. A local user can trigger a Denial of Service (DoS) by generating heavy sampling workloads or manipulating event controls, causing the kernel to improperly handle consecutive stop callbacks and unsafe list iterations. This failure can result in system instability or a kernel crash."], "name": "CVE-2026-99125", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-28T10:34:40Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99125\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99125\nhttps://git.kernel.org/stable/c/cf348ec613f75b9774291e47b804fd7010835a6c\nhttps://git.kernel.org/stable/c/f3110e969ad226ffbb2d9b4bf5387e68d0d9ef40"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9f66572f2889a5e72a9d7e17787e52f03b1f7bd8,cf348ec613f75b9774291e47b804fd7010835a6c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9f66572f2889a5e72a9d7e17787e52f03b1f7bd8,f3110e969ad226ffbb2d9b4bf5387e68d0d9ef40)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.11"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.11)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.13,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9f66572f2889a5e72a9d7e17787e52f03b1f7bd8,cf348ec613f75b9774291e47b804fd7010835a6c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9f66572f2889a5e72a9d7e17787e52f03b1f7bd8,f3110e969ad226ffbb2d9b4bf5387e68d0d9ef40)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.11"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.11)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.13,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-28T11:45:09.959723+00:00", "updated": "2026-10-30T05:30:09.661132+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}