CVE-2026-31782: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-31782 Overview

CVE-2026-31782 is a Linux kernel vulnerability in the x86 performance monitoring (perf/x86) subsystem. The flaw exists in the intel_pmu_hw_config function and relates to incorrect use of container_of when Auto Counter Reload (ACR) groups contain software events. A software event PMU is not an x86_hybrid_pmu, so passing it through the hybrid helper triggers an out-of-bounds memory read [CWE-125]. The Linux kernel maintainers resolved the issue by guarding the call to intel_pmu_set_acr_caused_constr with an is_x86_event check.

Critical Impact
A local authenticated user can trigger out-of-bounds memory reads in the kernel through crafted perf_event_open calls, leading to information disclosure, kernel instability, or potential privilege escalation.

Affected Products

Linux kernel (mainline) versions containing the Intel PMU Auto Counter Reload code path
Stable kernel branches prior to commits bfee04838f63, dbde07f06226, and e435a30ca6fe
Distributions shipping vulnerable Intel perf/x86 hybrid PMU support

Discovery Timeline

2026-05-01 - CVE-2026-31782 published to NVD
2026-05-03 - Last updated in NVD database

Technical Details for CVE-2026-31782

Vulnerability Analysis

The vulnerability resides in the Intel Performance Monitoring Unit (PMU) configuration logic within the Linux kernel perf/x86 subsystem. Auto Counter Reload (ACR) allows event groups that may include software-only events alongside hardware events. When intel_pmu_hw_config processes such a group, it invokes intel_pmu_set_acr_caused_constr through a hybrid PMU helper.

The helper performs a container_of operation that assumes the embedded structure is an x86_hybrid_pmu. Software event PMUs do not have this enclosing structure. The resulting pointer arithmetic addresses memory outside the intended object, producing an out-of-bounds read.

Local exploitation requires the ability to call perf_event_open and construct a mixed event group. The condition is reachable on systems exposing Intel hybrid PMU functionality with ACR support.

Root Cause

The root cause is the absence of a type check before applying container_of to a generic pmu pointer. Software event PMUs share the base struct pmu type but are not embedded in x86_hybrid_pmu. Treating them as such yields a bogus container address.

Attack Vector

A local user with permission to create perf events can craft an event group combining software events with hardware events configured for Auto Counter Reload. Submitting this group via perf_event_open drives the kernel down the vulnerable code path, producing the out-of-bounds read inside kernel memory.

No verified public exploit code is available for CVE-2026-31782. The fix adds an is_x86_event guard so the helper is only invoked for genuine x86 hardware events.

Detection Methods for CVE-2026-31782

Indicators of Compromise

Kernel log entries referencing intel_pmu_hw_config, intel_pmu_set_acr_caused_constr, or KASAN out-of-bounds reports on x86 PMU code paths
Unexpected kernel crashes, oopses, or warnings on Intel hybrid CPUs after perf_event_open activity
Unprivileged processes invoking perf_event_open with mixed software and hardware event groups

Detection Strategies

Audit perf_event_open syscall usage by non-root users and flag groups mixing PMU types with ACR attributes
Enable KASAN on test kernels to surface the out-of-bounds read deterministically during fuzzing or QA
Compare running kernel versions against the patched commits bfee04838f63, dbde07f06226, and e435a30ca6fe

Monitoring Recommendations

Forward dmesg and auditd records to a centralized log platform for kernel fault correlation
Restrict kernel.perf_event_paranoid to 2 or higher and alert on attempts to lower the value
Track package versions across the fleet to identify hosts running unpatched kernels

How to Mitigate CVE-2026-31782

Immediate Actions Required

Apply the upstream kernel fixes in commits bfee04838f63, dbde07f06226, and e435a30ca6fe or install vendor-supplied kernel updates that include them
Reboot affected hosts after updating the kernel package to activate the patched code path
Limit local access on multi-tenant Intel systems until patches are deployed

Patch Information

The upstream resolution adds an is_x86_event check that prevents intel_pmu_set_acr_caused_constr from running against software event PMUs. Patched commits are available at the Linux kernel git tree (bfee04838f63), (dbde07f06226), and (e435a30ca6fe).

Workarounds

Set kernel.perf_event_paranoid=2 (or 3 where supported) via sysctl to restrict unprivileged use of perf_event_open
Disable or restrict access to performance monitoring for untrusted local users using SELinux, AppArmor, or seccomp policies
Avoid running multi-tenant workloads on Intel hybrid CPUs with ACR-capable kernels until patched

bash

# Configuration example: restrict perf_event_open for unprivileged users
sudo sysctl -w kernel.perf_event_paranoid=3
echo 'kernel.perf_event_paranoid = 3' | sudo tee /etc/sysctl.d/99-perf-restrict.conf

# Verify running kernel version after patching
uname -r