LiveActive security incident?Get immediate response
CVE Record

CVE-2024-26992: KVM: x86/pmu: Disable support for adaptive PEBS

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/pmu: Disable support for adaptive PEBS Drop support for virtualizing adaptive PEBS, as KVM's implementation is architecturally broken without an obvious/easy path forward, and because exposing adaptive PEBS can leak host LBRs to the guest, i.e. can leak host kernel addresses to the guest. Bug #1 is that KVM doesn't account for the upper 32 bits of IA32_FIXED_CTR_CTRL when (re)programming fixed counters, e.g fixed_ctrl_field() drops the upper bits, reprogram_fixed_counters() stores local variables as u8s and truncates the upper bits too, etc. Bug #2 is that, because KVM _always_ sets precise_ip to a non-zero value for PEBS events, perf will _always_ generate an adaptive record, even if the guest requested a basic record. Note, KVM will also enable adaptive PEBS in individual *counter*, even if adaptive PEBS isn't exposed to the guest, but this is benign as MSR_PEBS_DATA_CFG is guaranteed to be zero, i.e. the guest will only ever see Basic records. Bug #3 is in perf. intel_pmu_disable_fixed() doesn't clear the upper bits either, i.e. leaves ICL_FIXED_0_ADAPTIVE set, and intel_pmu_enable_fixed() effectively doesn't clear ICL_FIXED_0_ADAPTIVE either. I.e. perf _always_ enables ADAPTIVE counters, regardless of what KVM requests. Bug #4 is that adaptive PEBS *might* effectively bypass event filters set by the host, as "Updated Memory Access Info Group" records information that might be disallowed by userspace via KVM_SET_PMU_EVENT_FILTER. Bug #5 is that KVM doesn't ensure LBR MSRs hold guest values (or at least zeros) when entering a vCPU with adaptive PEBS, which allows the guest to read host LBRs, i.e. host RIPs/addresses, by enabling "LBR Entries" records. Disable adaptive PEBS support as an immediate fix due to the severity of the LBR leak in particular, and because fixing all of the bugs will be non-trivial, e.g. not suitable for backporting to stable kernels. Note! This will break live migration, but trying to make KVM play nice with live migration would be quite complicated, wouldn't be guaranteed to work (i.e. KVM might still kill/confuse the guest), and it's not clear that there are any publicly available VMMs that support adaptive PEBS, let alone live migrate VMs that support adaptive PEBS, e.g. QEMU doesn't support PEBS in any capacity.

HighCVSS 7.3Not KEV-listedUpdated
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A virtual machine may obtain host kernel addresses through a flaw in Linux KVM’s virtualization of Intel adaptive PEBS. This crosses the guest-host security boundary and could weaken protections against further host attacks. The supplied CVSS score is 7.3.

Executive priority

Prioritize multi-tenant or untrusted-workload KVM hosts because the issue crosses isolation boundaries and exposes host kernel addresses. Patch promptly through normal kernel maintenance, while testing migration-sensitive environments. Lower priority may be reasonable only after confirming adaptive PEBS cannot reach guests.

Technical view

KVM and perf mishandle adaptive PEBS configuration, record generation, event filtering, and Last Branch Record state. A guest can potentially receive stale host LBR entries containing host instruction addresses. The upstream remediation disables adaptive PEBS virtualization because safely correcting every identified defect was unsuitable for stable backports.

Likely exposure

Exposure concerns Linux KVM hosts running affected kernel branches where Intel adaptive PEBS is available to guests. Exact distribution exposure depends on backports. The source says QEMU does not support PEBS, potentially limiting common deployments, but administrators should verify their actual VMM and kernel configuration.

Exploitation context

The CVSS vector characterizes exploitation as local, low-complexity, requiring low privileges and no user interaction. The primary documented outcome is high-confidentiality host address leakage, with possible low-integrity impact. This CVE is not identified as KEV, and the supplied sources do not report active exploitation.

Researcher notes

The disclosure identifies five related defects rather than one isolated coding error. The most serious is failure to sanitize LBR state before vCPU entry. Event-filter bypass is described as possible, not confirmed. Public sources supplied here do not establish a working exploit, exploitation in the wild, or applicability to every KVM configuration.

Mitigation direction

  • Install a vendor-supported kernel containing the applicable linked stable fix.
  • Follow the Linux distribution’s advisory to determine the corrected package for each kernel branch.
  • If upgrades are delayed, obtain vendor guidance for preventing adaptive PEBS exposure to guests.
  • Stage remediation where migration compatibility or performance-monitoring features are operationally important.

Validation and detection

  • Inventory KVM hosts, running kernel versions, CPU models, VMMs, and guest-visible PMU capabilities.
  • Confirm each deployed kernel package incorporates the applicable upstream stable fix or distribution backport.
  • Verify adaptive PEBS is no longer exposed to guests after remediation.
  • Test live migration and monitoring workloads because disabling adaptive PEBS may affect compatibility.
Prepared
Confidence
high
Sources
6

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-26992 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.3 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
2ADP providers
8Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.3CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N24.7Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.3High
CVSS 3.1 vector shape for CVE-2024-26992Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
other:ssvc
Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxc59a1f106f5cd4843c097069ff1bb2ad72103a67, c59a1f106f5cd4843c097069ff1bb2ad72103a67, c59a1f106f5cd4843c097069ff1bb2ad72103a67, c59a1f106f5cd4843c097069ff1bb2ad72103a67unaffected
LinuxLinux6.0, 0, 6.1.88, 6.6.29, 6.8.8, 6.9affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.