Executive brief
The Linux kernel's ARM performance monitoring unit (PMUv3) driver failed to properly initialize memory used for branch recording data before passing it to userspace applications. This could allow applications to read uninitialized kernel memory, potentially exposing sensitive information from previous kernel operations.
Technical details
The vulnerability is an information disclosure issue in the ARM PMUv3 performance monitoring driver. The BRBE (Branch Record Buffer Extension) support exposes the hw_id field via PERF_SAMPLE_BRANCH_HW_INDEX, but the branch_stack structure was allocated with kmalloc() rather than kzalloc(), leaving the hw_id field uninitialized. This allows userspace perf tools reading branch sampling data to access uninitialized kernel heap memory. The fix changes kmalloc() to kzalloc() to zero-initialize the entire structure, ensuring hw_id and future fields contain known values as per architectural documentation.
Affected products
- Linux Linux Kernel versions with arm_pmuv3 BRBE support
Timeline
- 2026-09-17: disclosed
- 2026-08-07: patched: Upstream commit 7c3b63386c27bed8d59a4b4c283d02860420eb0a