CVE-2026-99125 s390/pai: Handle multiple PMU stop callback invocations
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-99125?
CVE-2026-99125 is a vulnerability in Linux, published on 28 Oct 2026.
Official description
In the Linux kernel, the following vulnerability has been resolved:
s390/pai: Handle multiple PMU stop callback invocations
Handle the following scenario: The kernel protects itself against a very high sampling load and throttles the sampling using:
perf_event_throttle() --> PMU->stop()
Shortly later the scheduler may terminate the task and removes it from the CPU. It again calls
PMU->stop()
which results in two invocations of PMU->stop() called back to back. Protect against this and check the PERF_HES_STOPPED bit on function entry. If it is already set return. Clear bit PERF_HES_STOPPED in PMU->start().
Prohibit ioctl(fd, PERF_EVENT_IOC_PERIOD, ...) call for this event. It sets perf_event::event_limit to a positive value and causes perf_event_overflow() to invoke pai_stop() call back function when perf_event::event_limit hits zero. This is not supported because the sample events CRYPTO_ALL and NNPA_ALL are only taken at schedule out of a task.
Use list_for_each_entry_safe() for safe iteration over syswide_list in pai_have_samples().
Which versions are affected by CVE-2026-99125?
How do I fix CVE-2026-99125?
Upgrade to a fixed version.
Is CVE-2026-99125 being exploited?
There is no known exploitation of CVE-2026-99125 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-99125, DEBIAN-CVE-2026-99125, GHSA-83qv-jr76-p4xc, UBUNTU-CVE-2026-99125.