Cloudanix VulnDB

CVE-2026-98551

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A Linux kernel bug on arm64 computers could let a local user see leftover pieces of internal kernel data when using performance monitoring tools.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Data Exposure
Component
OS kernel
Class
Information Disclosure
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Kernel memory disclosure via uninitialized fields (new_type, priv) in perf_branch_entry structs returned to userspace on arm64; kmalloc-allocated branch stack buffers leak prior slab contents or uninitialized data when BRBE records are generated for unrecognized types or source-only entries.

Why it matters to the business

Low-probability exposure of kernel memory contents on arm64 Linux systems using perf branch sampling; may aid local attackers in information gathering but requires specific perf usage and arm64 hardware.

How an attack unfolds

An attacker with local access invokes perf with branch sampling on an arm64 system; the BRBE path in arm_pmuv3.c returns partially uninitialized perf_branch_entry records containing leftover kmalloc data, which is copied to userspace.

How to fix it

Update to a Linux kernel containing the commit that replaces per-field clearing with full struct assignment (or equivalent) in perf/core and removes perf_clear_branch_entry_bitfields; rebuild and reboot arm64 systems.

How to confirm the fix worked

Confirm the perf_clear_branch_entry_bitfields function and its call sites have been removed, and that perf_entry_from_brbe_regset and brbe_set_perf_entry_type perform full struct initialization or zeroing of new_type/priv.

Typical attack path

  1. Obtain local unprivileged access on arm64 Linux
  2. Invoke perf record or equivalent with branch-stack sampling enabled
  3. Trigger BRBE records for unrecognized branch types or source-only entries
  4. Read leaked kernel memory from returned perf_branch_entry structs

How to detect it

Review perf branch sampling logs or userspace perf.data files for unexpected non-zero values in new_type or priv fields; no network or file-based indicators exist.

What your security team should do

  • Prioritize kernel updates on arm64 systems within standard patch windows given low EPSS and no KEV listing
  • Audit any custom perf-based monitoring or sampling tools for branch record handling
  • Monitor upstream stable kernel releases for backports of the fix

The record

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fill branch entries with a single assignment perf_clear_branch_entry_bitfields() clears the bitfields of struct perf_branch_entry one by one and leaves from/to alone, since callers overwrite those straight away. The list has to be kept in sync with the struct by hand and has already fallen behind: new_type and priv were added to perf_branch_entry and never added here. Only BRBE writes those two, and neither for every record. brbe_set_perf_entry_type() leaves new_type alone for a branch type it does not recognise, and priv is not set for source-only records. arm_pmuv3.c allocates the per-CPU branch stack with kmalloc(), so such a record reaches userspace with whatever the slot held: uninitialised kmalloc() data on the first pass over the buffer, the previous record's values after that. Nothing under arch/x86/events/ writes either field, so only arm64 is affected. Assign the whole entry at each site instead. Everything not named is then zero, and there is no list to keep in sync. The bitfields add up to exactly 64 bits, so the struct has no padding to leave undefined. perf_clear_branch_entry_bitfields() has no callers left, so remove it. perf_entry_from_brbe_regset() assigns an empty literal instead, since it fills from/to conditionally. PERF_BR_SPEC_NA is 0, so dropping the explicit spec assignment changes nothing.

Affected packages

Ecosystem Package Introduced Fixed