Go to homepageCyberStrike

Menu

Star on GitHub · 3.2k
Sign inDownload

CVE-2026-31528

7.8 · HIGH

In the Linux kernel, the following vulnerability has been resolved: perf: Make sure to use pmu_ctx->pmu for groups Oliver reported that x86_pmu_del() ended up doing an out-of-bound memory access…

Published Apr 22, 2026CWE-125EPSS 0.18%

Overview

CVE-2026-31528 is a high-severity vulnerability. It was published on April 22, 2026 and has a CVSS 3.1 base score of 7.8 (HIGH).

This vulnerability has a CVSS 3.1 base score of 7.8, rated HIGH. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

Technical description

In the Linux kernel, the following vulnerability has been resolved:

perf: Make sure to use pmu_ctx->pmu for groups

Oliver reported that x86_pmu_del() ended up doing an out-of-bound memory access

when group_sched_in() fails and needs to roll back.

This *should* be handled by the transaction callbacks, but he found that when

the group leader is a software event, the transaction handlers of the wrong PMU

are used. Despite the move_group case in perf_event_open() and group_sched_in()

using pmu_ctx->pmu.

Turns out, inherit uses event->pmu to clone the events, effectively undoing the

move_group case for all inherited contexts. Fix this by also making inherit use

pmu_ctx->pmu, ensuring all inherited counters end up in the same pmu context.

Similarly, __perf_event_read() should use equally use pmu_ctx->pmu for the

group case.

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References

Refgit.kernel.org/stable/c/35f7914e54fe7f13654c22ee045b05e4b6d8062bRefgit.kernel.org/stable/c/3a696e84a8b1fafdd774bb30d62919faf844d9e4Refgit.kernel.org/stable/c/4b9ce671960627b2505b3f64742544ae9801df97Refgit.kernel.org/stable/c/4c759446046500a1a6785b25725725c3ff087aceRefgit.kernel.org/stable/c/656f35b463995bee024d948440128230aacd81e1

How CyberStrike helps

Frequently asked questions

What is CVE-2026-31528?

CVE-2026-31528 is a high-severity vulnerability. It was published on April 22, 2026 and has a CVSS 3.1 base score of 7.8 (HIGH).

How severe is CVE-2026-31528?

This vulnerability has a CVSS 3.1 base score of 7.8, rated HIGH. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

How do I fix or remediate CVE-2026-31528?

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

How can CyberStrike help with CVE-2026-31528?

CyberStrike is an open-source, AI-augmented pentesting engine. Rather than flag a version number, it tests whether an issue like CVE-2026-31528 is actually reachable in your own applications and APIs, then verifies each finding before reporting it. That tells you if the weakness is a real, exploitable risk in your environment or a false positive you can safely deprioritize.

Related HIGH CVEs from 2026

View all
Browse by year2026202520242023202220212020201920182017201620152014201320122011201020092008200720062005200420032002200120001999