CVE-2026-99187 perf: Fix perf_pmu_migrate_context() leaving events behind
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-99187?
CVE-2026-99187 is a vulnerability in Linux, published on 28 Oct 2026.
Official description
In the Linux kernel, the following vulnerability has been resolved:
perf: Fix perf_pmu_migrate_context() leaving events behind
__perf_pmu_remove() walks the group leaders of a CPU and PMU with perf_event_groups_for_cpu_pmu(), removing each one as it goes. perf_remove_from_context() takes the leader out of the groups rbtree, after which rb_next() on that node returns NULL, prematurely ending the walk. Other groups stay behind in the source context.
On CPU hotplug, they are then torn down with the dying CPU. They keep running until teardown, while the PMU's interrupt and migrated events are on a new CPU, which drivers rely on never happening.
Walk ctx->event_list instead and pick out the PMU's events by their pmu_ctx.
Which versions are affected by CVE-2026-99187?
How do I fix CVE-2026-99187?
Upgrade to a fixed version.
Is CVE-2026-99187 being exploited?
There is no known exploitation of CVE-2026-99187 in the wild and no public exploit code.
Sources
Also known as AZL-111350, BELL-CVE-2026-99187, DEBIAN-CVE-2026-99187, GHSA-29rh-rvqr-jrpj, UBUNTU-CVE-2026-99187.