Executive brief
The Linux kernel's Intel performance monitoring unit (uncore) subsystem contains a logic error in CPU online/offline event handling that causes reference counting to fall out of sync. When a CPU comes online, the uncore monitoring box is never properly initialized on the first CPU in a die, leaving it permanently uninitialized. This causes the box to be incorrectly torn down during CPU offline operations, disrupting performance monitoring on systems with single CPUs per die.
Technical details
The vulnerability is a logic error in kernel/arch/x86/events/intel/uncore.c related to function call ordering in CPU hotplug handlers. In uncore_event_cpu_online(), uncore_box_ref() was called before uncore_change_context(), but the reference counting gate condition (box->cpu >= 0) fails because uncore_change_context() had not yet run, leaving box->cpu at -1. This causes the box to never initialize on the first CPU online, resulting in box->refcnt being one count below the true value. Conversely, in uncore_event_cpu_offline(), uncore_box_unref() was called after uncore_change_context(), preventing proper box teardown. The fix reorders function calls so ref/unref operations occur when box->cpu reflects the correct context. This is a kernel-only issue affecting uncore performance monitoring and requires no user interaction; it is local in nature affecting system stability during CPU hotplug events.
Affected products
- Linux Linux kernel All versions (patch released for upstream and stable series)
Timeline
- 2026-09-17: disclosed
- 2026-06-30: patched: Upstream fix by Peter Zijlstra