{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72325", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-09T03:40:39.919Z", "datePublished": "2026-08-15T05:55:36.148Z", "dateUpdated": "2026-08-15T05:55:36.148Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-15T05:55:36.148Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/x86/amd/core: Avoid enabling BRS from the SVM reload path\n\nBranch Sampling (BRS) and Last Branch Record (LBR) are mutually\nexclusive hardware features, and users of both are tracked via\ncpuc->lbr_users.\n\nWhen SVM is toggled on a CPU, the host perf events are reprogrammed to\nupdate the HostOnly filter bit (set when virtualization is enabled,\ncleared when it is disabled). On PerfMonV2-capable processors, this\nreprogramming is performed by calling amd_pmu_enable_all() to rewrite\nthe event selectors. However, amd_pmu_enable_all() also calls\namd_brs_enable_all(), which enables BRS whenever cpuc->lbr_users > 0.\nHaving active LBR events satisfies this gating on processors that have\nLBR but not BRS. The kernel then tries to set the BRS enable bit in\nDebugExtnCfg (MSR 0xc000010f). Since that bit is deprecated on such\nhardware, the write results in a #GP:\n\n Call Trace:\n <IRQ>\n amd_pmu_enable_all+0x1d/0x90\n amd_pmu_disable_virt+0x62/0xb0\n kvm_arch_disable_virtualization_cpu+0xa/0x40 [kvm]\n hardware_disable_nolock+0x1a/0x30 [kvm]\n __flush_smp_call_function_queue+0x9b/0x410\n __sysvec_call_function+0x18/0xc0\n sysvec_call_function+0x69/0x90\n </IRQ>\n <TASK>\n asm_sysvec_call_function+0x16/0x20\n RIP: 0010:cpuidle_enter_state+0xc4/0x450\n ? cpuidle_enter_state+0xb7/0x450\n cpuidle_enter+0x29/0x40\n cpuidle_idle_call+0xf5/0x160\n do_idle+0x7b/0xe0\n cpu_startup_entry+0x26/0x30\n start_secondary+0x115/0x140\n secondary_startup_64_no_verify+0x194/0x19b\n </TASK>\n\nFix this by ensuring that BRS is not enabled from the event selector\nreprogramming path even when cpuc->lbr_users > 0."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/x86/events/amd/core.c"], "versions": [{"version": "bae19fdd7e9e759580ac4693d2df3bc23ab415d7", "lessThan": "e9b1a7411a667539c2f55e720bbb5f623b526a32", "status": "affected", "versionType": "git"}, {"version": "bae19fdd7e9e759580ac4693d2df3bc23ab415d7", "lessThan": "7cc438c99bba324a0562b1bafa747b10f7e251df", "status": "affected", "versionType": "git"}, {"version": "bae19fdd7e9e759580ac4693d2df3bc23ab415d7", "lessThan": "46d0fd8535edce31f15e48d2de1bdee39a4850e5", "status": "affected", "versionType": "git"}, {"version": "bae19fdd7e9e759580ac4693d2df3bc23ab415d7", "lessThan": "07c60dda9c059c09f83d42a3ebda2e7cc1cf3bc2", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/x86/events/amd/core.c"], "versions": [{"version": "5.19", "status": "affected"}, {"version": "0", "lessThan": "5.19", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.97", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2-rc3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.12.97"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "7.2-rc3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e9b1a7411a667539c2f55e720bbb5f623b526a32"}, {"url": "https://git.kernel.org/stable/c/7cc438c99bba324a0562b1bafa747b10f7e251df"}, {"url": "https://git.kernel.org/stable/c/46d0fd8535edce31f15e48d2de1bdee39a4850e5"}, {"url": "https://git.kernel.org/stable/c/07c60dda9c059c09f83d42a3ebda2e7cc1cf3bc2"}], "title": "perf/x86/amd/core: Avoid enabling BRS from the SVM reload path", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["arch/x86/events/amd/core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "e9b1a7411a667539c2f55e720bbb5f623b526a32", "status": "affected", "version": "bae19fdd7e9e759580ac4693d2df3bc23ab415d7", "versionType": "git"}, {"lessThan": "7cc438c99bba324a0562b1bafa747b10f7e251df", "status": "affected", "version": "bae19fdd7e9e759580ac4693d2df3bc23ab415d7", "versionType": "git"}, {"lessThan": "46d0fd8535edce31f15e48d2de1bdee39a4850e5", "status": "affected", "version": "bae19fdd7e9e759580ac4693d2df3bc23ab415d7", "versionType": "git"}, {"lessThan": "07c60dda9c059c09f83d42a3ebda2e7cc1cf3bc2", "status": "affected", "version": "bae19fdd7e9e759580ac4693d2df3bc23ab415d7", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["arch/x86/events/amd/core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.19"}, {"lessThan": "5.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.97", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2-rc3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/x86/amd/core: Avoid enabling BRS from the SVM reload path\n\nBranch Sampling (BRS) and Last Branch Record (LBR) are mutually\nexclusive hardware features, and users of both are tracked via\ncpuc->lbr_users.\n\nWhen SVM is toggled on a CPU, the host perf events are reprogrammed to\nupdate the HostOnly filter bit (set when virtualization is enabled,\ncleared when it is disabled). On PerfMonV2-capable processors, this\nreprogramming is performed by calling amd_pmu_enable_all() to rewrite\nthe event selectors. However, amd_pmu_enable_all() also calls\namd_brs_enable_all(), which enables BRS whenever cpuc->lbr_users > 0.\nHaving active LBR events satisfies this gating on processors that have\nLBR but not BRS. The kernel then tries to set the BRS enable bit in\nDebugExtnCfg (MSR 0xc000010f). Since that bit is deprecated on such\nhardware, the write results in a #GP:\n\n Call Trace:\n <IRQ>\n amd_pmu_enable_all+0x1d/0x90\n amd_pmu_disable_virt+0x62/0xb0\n kvm_arch_disable_virtualization_cpu+0xa/0x40 [kvm]\n hardware_disable_nolock+0x1a/0x30 [kvm]\n __flush_smp_call_function_queue+0x9b/0x410\n __sysvec_call_function+0x18/0xc0\n sysvec_call_function+0x69/0x90\n </IRQ>\n <TASK>\n asm_sysvec_call_function+0x16/0x20\n RIP: 0010:cpuidle_enter_state+0xc4/0x450\n ? cpuidle_enter_state+0xb7/0x450\n cpuidle_enter+0x29/0x40\n cpuidle_idle_call+0xf5/0x160\n do_idle+0x7b/0xe0\n cpu_startup_entry+0x26/0x30\n start_secondary+0x115/0x140\n secondary_startup_64_no_verify+0x194/0x19b\n </TASK>\n\nFix this by ensuring that BRS is not enabled from the event selector\nreprogramming path even when cpuc->lbr_users > 0."}], "id": "CVE-2026-72325", "lastModified": "2026-08-15T06:22:05.547", "metrics": {}, "published": "2026-08-15T06:22:05.547", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/07c60dda9c059c09f83d42a3ebda2e7cc1cf3bc2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/46d0fd8535edce31f15e48d2de1bdee39a4850e5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7cc438c99bba324a0562b1bafa747b10f7e251df"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e9b1a7411a667539c2f55e720bbb5f623b526a32"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bae19fdd7e9e759580ac4693d2df3bc23ab415d7,e9b1a7411a667539c2f55e720bbb5f623b526a32)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bae19fdd7e9e759580ac4693d2df3bc23ab415d7,7cc438c99bba324a0562b1bafa747b10f7e251df)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bae19fdd7e9e759580ac4693d2df3bc23ab415d7,46d0fd8535edce31f15e48d2de1bdee39a4850e5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bae19fdd7e9e759580ac4693d2df3bc23ab415d7,07c60dda9c059c09f83d42a3ebda2e7cc1cf3bc2)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.97,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.40,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T10:30:05.217254+00:00", "updated": "2026-08-15T21:15:03.007363+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-665"]}