CVE-2026-98937

What it actually does

The permission check in perf_event_open() only verified perf_allow_kernel() against exclude_kernel and did not enforce the same check when kernel callchains were explicitly requested via exclude_callchain_kernel==0, allowing kernel address exposure without the required privilege.

Why it matters to the business

Unprivileged processes on Linux systems could obtain kernel call stack data, increasing the risk of kernel address leaks that aid further attacks; the issue affects any environment relying on the perf subsystem for monitoring or profiling.

How an attack unfolds

An attacker invokes perf_event_open() with attr settings that request kernel callchains while excluding kernel samples directly, bypassing the incomplete privilege gate and capturing kernel addresses that would normally require CAP_PERFMON or equivalent.

How to fix it

Upgrade the Linux kernel to a version containing the permission-check fix for perf/core; rebuild and deploy the updated kernel across all affected hosts, then restart services that rely on perf monitoring.

How to confirm the fix worked

Confirm the kernel source contains the updated perf_allow_kernel() call for both kernel sampling and kernel callchain requests; test by attempting the previously allowed attr combination from an unprivileged context and verifying the call is now rejected.

Typical attack path

1. Locate or compile a program that calls perf_event_open()
2. Set perf_event_attr.exclude_kernel=1 and exclude_callchain_kernel=0
3. Request kernel callchain data during event creation
4. Read resulting callchain samples containing kernel addresses

How to detect it

Search system call logs or eBPF traces for perf_event_open invocations that combine exclude_kernel=1 with exclude_callchain_kernel=0; correlate with process creation events from unprivileged users.

• perf_event_open.*exclude_kernel=1.*exclude_callchain_kernel=0
• attr.exclude_callchain_kernel == 0 && attr.exclude_kernel == 1

What your security team should do

• Prioritize kernel updates on any system where untrusted code can execute perf_event_open
• Audit existing perf-based monitoring tools for unnecessary kernel callchain collection
• Add kernel version checks to deployment pipelines within the next patch cycle