Cloudanix VulnDB

CVE-2026-99187

None

CVSS

—

EPSS

0.2%

Published

Oct 28, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A Linux kernel bug can leave performance tracking information attached to a processor that is being removed, which may cause monitoring or hardware drivers to behave unexpectedly.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Other
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Race condition in perf_pmu_migrate_context leaves PMU events stranded in the source CPU context after perf_remove_from_context invalidates the rbtree walk in __perf_pmu_remove; events remain attached to a CPU that is later torn down while their PMU and interrupts have moved.

Why it matters to the business

Systems performing CPU hotplug or dynamic processor management may experience kernel instability, incorrect performance data, or driver assumptions being violated until the kernel is updated.

How an attack unfolds

An attacker with local access triggers repeated CPU offline/online operations while perf events for the target PMU are active; the flawed walk leaves events behind, causing them to execute against a removed CPU and allowing state desynchronization that drivers do not expect.

How to fix it

Apply the upstream fix that replaces the group-leader walk with iteration over ctx->event_list filtered by pmu_ctx; rebuild and deploy the corrected kernel on all affected hosts.

How to confirm the fix worked

Confirm the presence of the corrected walk logic in perf/core.c or the equivalent commit; test by exercising CPU hotplug while monitoring perf events for the target PMU.

Typical attack path

  1. Obtain local execution on a system supporting CPU hotplug
  2. Create or attach to perf events on the affected PMU
  3. Repeatedly offline and online CPUs to invoke perf_pmu_migrate_context
  4. Observe stranded events and resulting PMU or driver misbehavior

How to detect it

Review kernel logs around CPU hotplug events for perf or PMU warnings; examine any crash dumps referencing perf_event or pmu_ctx structures after processor removal.

What your security team should do

  • Prioritize kernel updates on any fleet using CPU hotplug or live migration
  • Audit systems for custom perf-based monitoring that may interact with the affected paths
  • Monitor vendor kernel advisories for backported patches

The record

In the Linux kernel, the following vulnerability has been resolved: perf: Fix perf_pmu_migrate_context() leaving events behind __perf_pmu_remove() walks the group leaders of a CPU and PMU with perf_event_groups_for_cpu_pmu(), removing each one as it goes. perf_remove_from_context() takes the leader out of the groups rbtree, after which rb_next() on that node returns NULL, prematurely ending the walk. Other groups stay behind in the source context. On CPU hotplug, they are then torn down with the dying CPU. They keep running until teardown, while the PMU's interrupt and migrated events are on a new CPU, which drivers rely on never happening. Walk ctx->event_list instead and pick out the PMU's events by their pmu_ctx.

Affected packages

Ecosystem Package Introduced Fixed