CVE-2026-72325

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

perf/x86/amd/core: Avoid enabling BRS from the SVM reload path

Branch Sampling (BRS) and Last Branch Record (LBR) are mutually

exclusive hardware features, and users of both are tracked via

cpuc->lbr_users.

When SVM is toggled on a CPU, the host perf events are reprogrammed to

update the HostOnly filter bit (set when virtualization is enabled,

cleared when it is disabled). On PerfMonV2-capable processors, this

reprogramming is performed by calling amd_pmu_enable_all() to rewrite

the event selectors. However, amd_pmu_enable_all() also calls

amd_brs_enable_all(), which enables BRS whenever cpuc->lbr_users > 0.

Having active LBR events satisfies this gating on processors that have

LBR but not BRS. The kernel then tries to set the BRS enable bit in

DebugExtnCfg (MSR 0xc000010f). Since that bit is deprecated on such

hardware, the write results in a #GP:

Call Trace:

<IRQ>

amd_pmu_enable_all+0x1d/0x90

amd_pmu_d

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References