{"schema":"threatline.record/2","record":{"id":"CVE-2026-97960","aliases":[],"summary":"perf/x86/intel: Prevent drain_pebs() reentry","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nperf/x86/intel: Prevent drain_pebs() reentry\n\nThe PEBS buffer is shared by all events on a CPU, so drain_pebs() must\nnot be reentered. If so, one instance may observe stale buffer state and\npotentially access out-of-bound memory.\n\nMost invocations happen in NMI context, which naturally prevents reentry.\nHowever, drain_pebs() is also reachable from process context via\nintel_pmu_drain_pebs_buffer().\n\nIn those paths, the PMU is often already disabled, but not guaranteed.\nFor example, __intel_pmu_pebs_disable() only disables the target counter,\nso other active counters can still raise a PMI and interrupt an in-flight\ndrain_pebs(). Here is an example,\n\n__perf_addr_filters_adjust()\n  perf_event_stop()\n    __perf_event_stop()\n      x86_pmu_stop() (event->pmu->stop)\n        intel_pmu_disable_event()\n          intel_pmu_pebs_disable()\n            __intel_pmu_pebs_disable()\n              intel_pmu_drain_large_pebs()\n                intel_pmu_drain_pebs_buffer()\n\nIntroduce __intel_pmu_quiesce() and __intel_pmu_resume() helpers and\nuse them in intel_pmu_drain_large_pebs() to disable the full PMU\naround the intel_pmu_drain_pebs_buffer() call, preventing reentry.\n\nAlso add a warning in intel_pmu_drain_pebs_buffer() when the full PMU is\nnot disabled.","categories":["Operating systems"],"product":"Linux","vendor":"Linux","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97960","source_modified_at":"2026-10-21T12:53:50.943Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Linux","vendor":"Linux","versions":[{"version":"b752ea0c28e3f7f0aaaad6abf84f735eebc37a60","lessThan":"9882068ed242fcd4743f53027e8c790e88dcafff","status":"affected","versionType":"git"},{"version":"b752ea0c28e3f7f0aaaad6abf84f735eebc37a60","lessThan":"999e482fdf89400cc1ae937680fc05096b4c915b","status":"affected","versionType":"git"},{"version":"b752ea0c28e3f7f0aaaad6abf84f735eebc37a60","lessThan":"a5fe19dd8b3ed5fad6e5e0f0c58c7245043ee4af","status":"affected","versionType":"git"},{"version":"b752ea0c28e3f7f0aaaad6abf84f735eebc37a60","lessThan":"c55599c0ec2aa020e41a0599c3044c56d8a2e7d9","status":"affected","versionType":"git"},{"version":"b752ea0c28e3f7f0aaaad6abf84f735eebc37a60","lessThan":"a56c03a397e2cd0c4cf8da96dcd6214f7d0e7d8c","status":"affected","versionType":"git"},{"version":"a9165207b2b07415eeb01b3ac8bb84976ec96984","status":"affected","versionType":"git"},{"version":"6.3.7","lessThan":"6.4","status":"affected","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97960","source_modified_at":"2026-10-21T12:53:50.943Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Linux","vendor":"Linux","versions":[{"version":"6.4","status":"affected"},{"version":"0","lessThan":"6.4","status":"unaffected","versionType":"semver"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}],"defaultStatus":"affected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97960","source_modified_at":"2026-10-21T12:53:50.943Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"9882068ed242fcd4743f53027e8c790e88dcafff","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97960","source_modified_at":"2026-10-21T12:53:50.943Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"999e482fdf89400cc1ae937680fc05096b4c915b","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97960","source_modified_at":"2026-10-21T12:53:50.943Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"6.4","basis":"first unaffected version stated in the CVE record"}],"cvss":null,"severity":null,"kev":{"listed":false},"epss":{"probability":0.00168,"percentile":0.05744,"score_date":"2026-10-23"},"published_at":"2026-09-25T10:23:04.943Z","modified_at":"2026-10-21T12:53:50.943Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-97960","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-21T12:53:50.943Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97960","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://git.kernel.org/stable/c/9882068ed242fcd4743f53027e8c790e88dcafff"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/999e482fdf89400cc1ae937680fc05096b4c915b"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/a5fe19dd8b3ed5fad6e5e0f0c58c7245043ee4af"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/c55599c0ec2aa020e41a0599c3044c56d8a2e7d9"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/a56c03a397e2cd0c4cf8da96dcd6214f7d0e7d8c"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-21T12:53:50.943Z","content_hash":"8d2adeeb2d1dfdfa6380d1306e06cde8e28cf497fa370d956d7783c8f9e25c7f"}}