CVE-2026-93275

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

perf/x86/intel/pt: Fix stop/start with no update

If pt_event_stop() is called without PERF_EF_UPDATE flag, then

perf_aux_output_end() is not called. A subsequent call to pt_event_start()

will call perf_aux_output_begin() again which violates the rule against

nesting and triggers a WARNING in perf_aux_output_begin().

Originally, pt_event_stop() was never called without PERF_EF_UPDATE,

because the only code paths to do so are from event overflow, and Intel PT

does not do that.

However the introduction of group throttling by commit 9734e25fbf5ae

("perf: Fix the throttle logic for a group") meant that an Intel PT event

could be throttled if it was part of a group. Throttling calls PMU

->stop() / ->start() callbacks without flags.

An example is when AUX area sampling is used. The following commands

hit the issue:

echo 10000 > /proc/sys/kernel/perf_event_max_sample_rate

perf record -F32000 --aux-sample -e '{int

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References