Junglewise Threat Intelligence

CVE-2026-89460: Linux kernel s390 CPUMF NULL pointer dereference in hotplug

CVE-2026-89460 · Severity: info · Published 2026-09-11

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

The Linux kernel's CPU measurement facility (CPUMF) on IBM s390 systems crashes when CPUs are added back online during performance monitoring. A performance analysis tool running on the system can trigger a kernel panic when the scheduler tries to use a CPU that was offline when monitoring began, because the kernel failed to initialize the required data structures for that CPU.

Technical details

A NULL pointer dereference occurs in the cpumf_pmu_add() function when performance events with task context are monitored and CPUs are dynamically brought online after event creation. The root cause is that per-CPU counter infrastructure (struct cpu_cf_events) is only allocated for CPUs that are online at event initialization time. If a CPU comes online later and the scheduler assigns the monitored task to that CPU, cpumf_pmu_add() accesses uninitialized memory, causing a kernel panic. The fix introduces CPU hotplug prepare/dead callbacks that allocate and deallocate per-CPU counter data as CPUs enter and leave the offline state, independent of when monitoring began.

Affected products

  • Linux Linux kernel Not specified

Timeline

  • 2026-09-11: disclosed

Related threats