LiveActive security incident?Get immediate response
CVE Record

CVE-2026-31528: perf: Make sure to use pmu_ctx->pmu for groups

In the Linux kernel, the following vulnerability has been resolved: perf: Make sure to use pmu_ctx->pmu for groups Oliver reported that x86_pmu_del() ended up doing an out-of-bound memory access when group_sched_in() fails and needs to roll back. This *should* be handled by the transaction callbacks, but he found that when the group leader is a software event, the transaction handlers of the wrong PMU are used. Despite the move_group case in perf_event_open() and group_sched_in() using pmu_ctx->pmu. Turns out, inherit uses event->pmu to clone the events, effectively undoing the move_group case for all inherited contexts. Fix this by also making inherit use pmu_ctx->pmu, ensuring all inherited counters end up in the same pmu context. Similarly, __perf_event_read() should use equally use pmu_ctx->pmu for the group case.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A flaw in Linux performance monitoring can trigger an out-of-bounds kernel memory access during failed event-group scheduling and rollback. A local, low-privileged user may be able to compromise confidentiality, integrity, or availability. The supplied CVSS score is 7.8. No active exploitation is established by the provided sources.

Executive priority

Treat this as a high-priority kernel maintenance issue, especially for shared or multi-user Linux infrastructure. It is not supported as an emergency internet-wide threat because exploitation requires local access and no active exploitation is documented. Accelerate vendor-supported updates where untrusted users have local access.

Technical view

Inherited perf event groups can retain event->pmu instead of pmu_ctx->pmu. When a software event leads the group, rollback may invoke transaction handlers for the wrong PMU, causing x86_pmu_del() to access memory out of bounds. The fix consistently uses pmu_ctx->pmu for inherited group events and grouped reads.

Likely exposure

Exposure is limited to affected Linux kernels and requires local, low-privileged access without user interaction. Risk is higher on multi-user or shared systems where untrusted users can reach kernel performance-monitoring interfaces. The bundle lists affected versions but does not provide a clear fixed-version mapping for each maintained branch.

Exploitation context

The CVSS vector indicates a local, low-complexity, low-privilege attack with potential high impact across confidentiality, integrity, and availability. CISA KEV status is false, and the supplied sources provide no evidence of public exploitation, exploit availability, or attacks in the wild.

Researcher notes

The reported condition is an x86 perf rollback-path out-of-bounds access involving mixed-PMU groups and inherited contexts. The sources describe the faulty PMU selection and corrective commits, but do not establish exploitability details, reliable impact outcomes, public proof-of-concept availability, or complete branch-specific fixed-version boundaries.

Mitigation direction

  • Consult Linux distribution advisories for fixed packages covering CVE-2026-31528.
  • Upgrade to a vendor-supported kernel containing the applicable cited stable fix.
  • Prioritize shared systems allowing untrusted local users to access performance-monitoring facilities.
  • Apply vendor-recommended temporary restrictions if immediate kernel replacement is unavailable.

Validation and detection

  • Inventory kernel versions across physical hosts, virtual machines, and container hosts.
  • Compare installed versions against authoritative distribution advisories for CVE-2026-31528.
  • Confirm the running kernel includes the applicable cited stable commit after remediation.
  • Identify systems where untrusted local users can access performance-monitoring interfaces.
  • Reboot where required, then verify the fixed kernel is actually running.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-31528 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
6Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2026-31528Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxbd27568117664b8b3e259721393df420ed51f57b, bd27568117664b8b3e259721393df420ed51f57b, bd27568117664b8b3e259721393df420ed51f57b, bd27568117664b8b3e259721393df420ed51f57b, bd27568117664b8b3e259721393df420ed51f57bunaffected
LinuxLinux6.2, 0, 6.6.131, 6.12.80, 6.18.21, 6.19.11, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.