All vulnerabilities
CVE-2026-97526

Linux: s390/pai: Support CPU hotplug for PMU PAI

Linux LinuxOperating systems
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.19%Chance of exploitation activity in the next 30 days, higher than 8% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in706e2bf330144995d123dccf32aaf1981ce5abc2Also 9ecc4d033879f7761f2df07e20cd2fbec00fd90bCVE List
Published25 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 706e2bf330144995d123dccf32aaf1981ce5abc2LinuxCVE List
  • 9ecc4d033879f7761f2df07e20cd2fbec00fd90bLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

s390/pai: Support CPU hotplug for PMU PAI

The command 'perf stat -e pai_crypto/CRYPTO_ALL/ -- <command>' crashes the kernel when CPUs are hotplug added during that run.

Root cause is the missing allocation of per-CPU data structures for that new CPU. The allocation is dynamic and the first event that has task context creates such a structure for each online CPU. This is not sufficient. CPUs may be offline during event creation and can be set online during the perf run time. For example commands

echo 0 > /sys/devices/system/cpu/cpu1/online

perf stat -e cycles -i -- stress-ng -t10s --matrix X

sleep 1

echo 1 > /sys/devices/system/cpu/cpu1/online

Currently without a CPU hotplug handler, that new CPU has no per-CPU data infrastructure. The scheduler runs PMU call back function pai_add() to install the PMU support for that CPU before the task is being scheduled on that new CPU. In pai_add() instructions

mp = this_cpu_ptr(pai_root[idx].mapptr); cpump = mp->mapptr;

return a NULL pointer and the result is a kernel panic as variable cpump is used inside that function.

Add CPU hotplug support for CPU add and delete and create the necessary per-CPU data infrastructure during CPU hotplug add processing. Same for CPU hotplug remove. This is done when the CPU is offline to ensure the data structures are available when CPU is made online and tasks are scheduled on it.

[hca@linux.ibm.com: fixup error path in pai_init()]

Text from CVE List

Affected versions 6

  • Linuxaffected: 9f66572f2889a5e72a9d7e17787e52f03b1f7bd8 before 706e2bf330144995d123dccf32aaf1981ce5abc2CVE List
  • Linuxaffected: 9f66572f2889a5e72a9d7e17787e52f03b1f7bd8 before 9ecc4d033879f7761f2df07e20cd2fbec00fd90bCVE List
  • Linuxaffected: 6.11CVE List
  • Linuxunaffected: all versions before 6.11CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 2