CVE-2026-53114: Linux Kernel Privilege Escalation Flaw

CVE-2026-53114 Overview

CVE-2026-53114 is a Linux kernel vulnerability in the AMD Instruction-Based Sampling (IBS) performance monitoring subsystem. The flaw exists in the IBS Non-Maskable Interrupt (NMI) handler, which calls perf_allow_kernel() from NMI context. Calling this function from NMI context is unsafe and can be fatal to the running kernel. The upstream fix captures the permission at event-initialization time by storing it in event->hw.flags, allowing the NMI handler to consult the cached flag instead of invoking the call directly.

Critical Impact
An unsafe perf_allow_kernel() invocation from NMI context in the AMD IBS handler can destabilize the kernel and result in system crashes on affected AMD-based Linux hosts.

Affected Products

Linux kernel — perf/amd/ibs subsystem on AMD processors supporting Instruction-Based Sampling
Linux distributions shipping affected mainline and stable kernel branches prior to the fix commits
Workloads using perf events with AMD IBS hardware counters

Discovery Timeline

2026-06-24 - CVE-2026-53114 published to the National Vulnerability Database (NVD)
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53114

Vulnerability Analysis

The vulnerability resides in the AMD IBS performance event subsystem within the Linux kernel. IBS uses an NMI handler to deliver sampled instruction data to the perf framework. The handler invoked perf_allow_kernel() to verify whether the current event was permitted to access kernel-level samples. That function is not designed for execution inside NMI context, where preemption, locking primitives, and certain audit paths are unsafe to reach. The unsafe invocation could lead to kernel deadlocks, corruption of internal state, or fatal panics depending on the system configuration.

This is a kernel driver and locking-context defect rather than a remotely exploitable flaw. The available data does not indicate a CWE assignment, and no public exploit has been observed. The EPSS data set lists a very low likelihood of weaponized exploitation in the near term.

Root Cause

The root cause is improper context handling: perf_allow_kernel() performs operations that are not NMI-safe, yet the IBS NMI handler called it on every sample interrupt. The fix relocates the permission check to event-initialization time, when normal process context is available, and caches the decision in event->hw.flags. The NMI handler then reads this cached flag, eliminating the unsafe call path.

Attack Vector

Triggering the unsafe code path requires the use of AMD IBS performance events on a vulnerable kernel. A local user with permission to create perf events on supported AMD hardware can drive the NMI handler through normal sampling activity. The bug manifests as a kernel stability issue (denial of service) rather than a privilege escalation or code execution primitive. No network attack vector is described in the kernel commit notes.

The vulnerability is described in the upstream kernel commit notes. See Linux Kernel Commit 0584e74fa2b2, Linux Kernel Commit 2783ed2442ce, and Linux Kernel Commit b0a091422622 for technical details.

Detection Methods for CVE-2026-53114

Indicators of Compromise

Unexpected kernel panics or NMI watchdog timeouts on AMD systems running perf workloads that enable IBS sampling.
Kernel log entries referencing ibs, perf_allow_kernel, or NMI-related stack traces preceding a crash.
System hangs correlated with the launch of perf record or similar tools targeting AMD IBS counters.

Detection Strategies

Inventory Linux hosts running AMD CPUs and compare their kernel build versions against the patched stable releases referenced in the upstream commits.
Audit which users and workloads invoke perf events that enable IBS sampling, since exposure depends on local access to performance counters.
Correlate kernel crash dumps with perf activity to confirm whether the unsafe NMI path was reached.

Monitoring Recommendations

Forward kernel.log, dmesg, and kdump artifacts to a centralized logging or SIEM pipeline for review of NMI and IBS-related faults.
Alert on repeated kernel panics or NMI watchdog events on AMD hosts and prioritize investigation when perf workloads are active.
Track the value of /proc/sys/kernel/perf_event_paranoid across the fleet to understand which systems permit unprivileged perf event creation.

How to Mitigate CVE-2026-53114

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by the three stable commits as soon as distribution updates are available.
Restrict access to perf events by setting kernel.perf_event_paranoid to a value of 2 or higher on systems that do not require unprivileged sampling.
Limit interactive shell access on AMD hosts to trusted administrators while patches are being staged.

Patch Information

The fix is delivered through three upstream Linux kernel commits that move the perf_allow_kernel() check out of NMI context and into event initialization, caching the result in event->hw.flags. Reference the Linux Kernel Commit 0584e74fa2b2, Linux Kernel Commit 2783ed2442ce, and Linux Kernel Commit b0a091422622 for the authoritative source changes, then track each distribution's backport advisory for the corresponding package version.

Workarounds

Disable IBS sampling on AMD hosts by avoiding perf configurations that select IBS events until the patched kernel is deployed.
Tighten kernel.perf_event_paranoid so that only privileged users can create kernel-scope performance events.
Restrict the CAP_PERFMON and CAP_SYS_ADMIN capabilities to a minimal set of accounts on shared multi-tenant systems.

bash

# Configuration example
# Restrict perf event creation to privileged users
sudo sysctl -w kernel.perf_event_paranoid=2

# Persist the setting across reboots
echo 'kernel.perf_event_paranoid=2' | sudo tee /etc/sysctl.d/99-perf-paranoid.conf

# Verify the running kernel version against distribution advisories
uname -r