Executive brief
The Linux kernel's performance monitoring feature on Intel processors can inadvertently expose kernel memory addresses to unprivileged user programs through the Last Branch Record (LBR) stack. This information leak allows an attacker to bypass kernel address space layout randomization (KASLR), which is a critical defense mechanism. While the vulnerability itself does not enable direct code execution or data theft, the exposed addresses significantly weaken the system's memory protection against further exploits.
Technical details
The vulnerability exists in the Intel perf/x86 subsystem's LBR (Last Branch Record) filtering logic, specifically in the intel_pmu_lbr_filter() function. When a user requests PERF_SAMPLE_BRANCH_USER to capture only user-space branch records, the kernel fails to fully validate privilege levels of sampled entries—it checks some branch types against the destination address but does not reject entries with kernel-space source addresses. An unprivileged user can execute perf record with user-only branch filters on affected Intel processors (e.g., Tiger Lake) to collect kernel addresses. The fix extends software filtering to validate both source and destination addresses, dropping any LBR entry containing a kernel address when a user-only filter is requested. The vulnerability requires local access and the ability to use perf tracing on a system with vulnerable Intel hardware.
Affected products
- Linux Linux kernel Before patched versions (architecture-dependent)
Timeline
- 2026-09-16: disclosed