Executive brief
A vulnerability in the Linux kernel's performance monitoring subsystem for Intel processors could allow a local user to cause a system crash. This occurs when the system is configured with NUMA disabled and boots with fewer CPUs than expected on certain hardware components. The issue can lead to memory corruption, potentially impacting the stability and availability of the server.
Technical details
An array overflow vulnerability exists in the Linux kernel's 'perf/x86/intel/uncore' driver. The root cause is the 'uncore_pci_pmu_register' function continuing to parse discovery tables even when all CPUs in an associated processor die are offline, specifically when NUMA is disabled and the system boots with fewer CPUs than the number of CPUs in die 0. This leads to an out-of-bounds write at 'pmu->boxes[die] = box'. A local attacker could potentially trigger this condition to cause a kernel panic or other undefined behavior. Patches have been released across multiple stable kernel branches to skip discovery table parsing for offline dies by validating the die ID against 'uncore_max_dies()'.
Affected products
- Linux Linux Kernel 5.13 to 5.15.209, 5.16 to 6.1.175, 6.2 to 6.6.136, 6.7 to 6.12.83, 6.13 to 6.18.24, 6.19 to 6.19.14, 7.0-rc1 to 7.0-rc7
Timeline
- 2026-05-06: disclosed
- 2026-05-06: advisory
- 2026-04-07: patched: Initial patch in mainline kernel tree
References
- https://git.kernel.org/stable/c/6cfc187d85f18f976d0fe527d4c6f6171542cc19
- https://git.kernel.org/stable/c/7a2cb02437d92ed14fe494d8994056d5bd2c72b4
- https://git.kernel.org/stable/c/7b568e9eba2fad89a696f22f0413d44cf4a1f892
- https://git.kernel.org/stable/c/cfab2c817d2e7e0bee98d66850246ce842ed5f18
- https://git.kernel.org/stable/c/d18da11a5e21eac7651c8897e5e0908f6c2bc9de
- https://git.kernel.org/stable/c/dfcba8c8674cead6c88a2f269b71aa4efd3d384a
- https://git.kernel.org/stable/c/f34feda8e0c9535fee3f8870ce8bab53c2798f71