CVE-2026-80602perf/x86/amd/lbr: Fix kernel address leakage
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd/lbr: Fix kernel address leakage A user-only branch stack can contain branches that originate from the kernel. As a result, kernel addresses are exposed to user space even when PERF_SAMPLE_BRANCH_USER is requested. On AMD processors supporting X86_FEATURE_AMD_LBR_V2, perf can still report SYSRET/ERET entries for which the branch-from addresses are in the kernel. E.g. $ perf record -e cycles -o - -j any,save_type,u -- \ perf bench syscall basic --loop 1000 | \ perf script -i - -F brstack|tr ' ' '\n'| \ grep -E '0x[89a-f][0-9a-f]{15}' ... 0xffffffff81001268/0x717a90a38f1a/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH 0xffffffff81001268/0x717a90a39157/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH 0xffffffff81001268/0x717a90a2c628/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH 0xffffffff81001268/0x717a90a41b60/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH 0xffffffff81001268/0x717a90a260db/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH 0xffffffff81001268/0x717a90a260db/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH 0xffffffff81001268/0x717a8bef1c30/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH 0xffffffff81001268/0x717a8e4d3c90/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH ... The reason is that the hardware filter only considers the privilege level applicable to the branch target. Extend software filtering to also validate the branch-from addresses against br_sel, so that any branch record whose branch-from address is in the kernel is dropped when PERF_SAMPLE_BRANCH_USER is requested.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 28, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from f4f925dae7419fc7a10af539c073871927ce3a24 before 5be478c1e08981ca91b34de310d7e2638171d9d8; from f4f925dae7419fc7a10af539c073871927ce3a24 before 208ecca408b1707ad86ea247d3d3e09d3606fc13; from f4f925dae7419fc7a10af539c073871927ce3a24 before 5ab0eba9c8819506bcb72348fd701f8a9006f95e; from f4f925dae7419fc7a10af539c073871927ce3a24 before fb3b76b5ad2ebad63dd76f8b65b624eaf638b73f; from f4f925dae7419fc7a10af539c073871927ce3a24 before 2a892294b83f541115c94b0bb637f39bef187657 | CNA record |
References
- https://git.kernel.org/stable/c/5be478c1e08981ca91b34de310d7e2638171d9d8
- https://git.kernel.org/stable/c/208ecca408b1707ad86ea247d3d3e09d3606fc13
- https://git.kernel.org/stable/c/5ab0eba9c8819506bcb72348fd701f8a9006f95e
- https://git.kernel.org/stable/c/fb3b76b5ad2ebad63dd76f8b65b624eaf638b73f
- https://git.kernel.org/stable/c/2a892294b83f541115c94b0bb637f39bef187657
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.