Summary
Vulnerability in Linux kernel (CVE-2026-31782). Successful exploitation can lead to full system takeover.
Original description
The description as published by the source.
In the Linux kernel, the following vulnerability has been resolved:
perf/x86: Fix potential bad container_of in intel_pmu_hw_config
Auto counter reload may have a group of events with software events
present within it. The software event PMU isn't the x86_hybrid_pmu and
a container_of operation in intel_pmu_set_acr_caused_constr (via the
hybrid helper) could cause out of bound memory reads. Avoid this by
guarding the call to intel_pmu_set_acr_caused_constr with an
is_x86_event check.
Source: NIST National Vulnerability Database NVD GitHub Advisory
AI summary
Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.
Linuxカーネルにおけるperf/x86モジュールに、メモリの範囲外読み取りの可能性がある脆弱性が存在しました。この問題は、intel_pmu_hw_configにおけるcontainer_of操作の不備に起因します。脆弱性はすでに修正されています。
Linuxカーネルのperf/x86におけるメモリの範囲外読み取りの可能性。
Linuxカーネルのperf/x86モジュール
範囲外メモリ読み取りは、データ漏洩やシステムの不安定化につながる可能性があります。CVSSスコアは7.8で、高度な深刻度と評価されています。
intel_pmu_set_acr_caused_constrをis_x86_eventチェックで保護することで問題を修正しました。
情報なし
情報なし
Affected packages
Fix status by distribution
Fixed packages published by each distribution for this CVE
- BellSoft Alpaquita BELL-CVE-2026-31782 linux-lts Fixed in: 6.18.35-r1
- Debian DEBIAN-CVE-2026-31782 linux Fixed in: 6.19.12-1
- Ubuntu UBUNTU-CVE-2026-31782 linux-hwe-edge
References
- advisory nvd.nist.gov
- advisory github.com
- package git.kernel.org
- web git.kernel.org
- web git.kernel.org
- web git.kernel.org
- web github.com