s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks
In the Linux kernel, the following vulnerability has been resolved: s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks The command 'perf stat -e cycles -- ' crashes the kernel when CPUs are hotplug added during that run. Root cause is the allocation of struct cpu_cf_events at first event initialization. The allocation is dynamic and the first event that has task context creates such a structure for each online CPU. This is not sufficient. CPUs may be offline during event creation and can be set online during the perf run time. For example commands # echo 0 > /sys/devices/system/cpu/cpu1/online # perf stat -e cycles -i -- stress-ng -t10s --matrix X # sleep 1 # echo 1 > /sys/devices/system/cpu/cpu1/online create an event for CPUs 0,2-X. Since the events are created with task-context, the scheduler will eventually schedule the program on CPU1. This CPU has not created and initialized any per CPU event infrastructure as that CPU was not online at the time of the perf invocation. Thus when the scheduler runs stress-ng on CPU1, the function cpumf_pmu_add() refers to a NULL pointer: struct cpu_cf_events *cpuhw = this_cpu_cfhw(); This function call is invoked after the task stress-ng has been made runnable on CPU1. And this_cpu_cfhw() returns NULL. The result is a panic: Unable to handle kernel pointer dereference in virtual kernel address space Failing address: 0000000000000000 TEID: 0000000000000483 .... Krnl PSW : 0404d00180000000 000003ef8291fd0c (cpumf_pmu_add+0x3c/0x80
CVE-2026-89460
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-89460
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "9b9cf3c77e7e090b30657b3d2c288deb58dfb4f2",
"lessThan": "991be92489bc7b1b6e7903debb96bd58c892dee4",
"versionType": "git"
},
{
"status": "affected",
"version": "9b9cf3c77e7e090b30657b3d2c288deb58dfb4f2",
"lessThan": "777d040c2f91d8d929b4a32333dfe4102b27caea",
"versionType": "git"
},
{
"status": "affected",
"version": "9b9cf3c77e7e090b30657b3d2c288deb58dfb4f2",
"lessThan": "dcce7a06ea690d5cf46a705a9b74cf0398ac091f",
"versionType": "git"
},
{
"status": "affected",
"version": "9b9cf3c77e7e090b30657b3d2c288deb58dfb4f2",
"lessThan": "71d46de9153e067c63a15f3b00e6364e1c0230f8",
"versionType": "git"
},
{
"status": "affected",
"version": "9b9cf3c77e7e090b30657b3d2c288deb58dfb4f2",
"lessThan": "337bd95507a16063687cfc286ea90de5cca48c37",
"versionType": "git"
}
],
"programFiles": [
"arch/s390/kernel/perf_cpum_cf.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.5"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.5",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.109",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.50",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.4",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"arch/s390/kernel/perf_cpum_cf.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-89460
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #34991 · Revision 1
- Added to Heist Feed
- Publisher date