CVE-2026-80602: Linux Kernel Information Disclosure Flaw

CVE-2026-80602 Overview

CVE-2026-80602 is an information disclosure vulnerability in the Linux kernel's perf/x86/amd/lbr subsystem. On AMD processors supporting X86_FEATURE_AMD_LBR_V2, a user-only branch stack can contain branches originating from the kernel. This exposes kernel addresses to unprivileged user space even when PERF_SAMPLE_BRANCH_USER is requested. The hardware Last Branch Record (LBR) filter only evaluates the privilege level of the branch target, allowing SYSRET and ERET entries with kernel branch-from addresses to reach userspace consumers. Leaked kernel pointers defeat Kernel Address Space Layout Randomization (KASLR) and assist attackers in constructing local privilege escalation exploits.

Critical Impact
Unprivileged local users on affected AMD systems can extract kernel virtual addresses through the perf subsystem, undermining KASLR protections.

Affected Products

Linux kernel builds with perf/x86/amd/lbr support enabled
Systems running on AMD CPUs supporting X86_FEATURE_AMD_LBR_V2
Kernel versions prior to the commits referenced in the stable git tree

Discovery Timeline

2026-08-28 - CVE-2026-80602 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-80602

Vulnerability Analysis

The AMD Last Branch Record version 2 (LBR v2) hardware feature records recent branch source and target addresses to help profilers reconstruct execution flow. When user-space profilers request PERF_SAMPLE_BRANCH_USER, the kernel is expected to return only branches whose execution occurred at user privilege. On AMD LBR v2 the hardware filter evaluates only the branch target's privilege level. Transitions from kernel back to user, such as SYSRET and ERET, are therefore recorded with a kernel branch-from address and a user branch-to address, and the hardware admits them as user branches.

The supplied reproducer using perf record -e cycles -j any,save_type,u shows branch-from values such as 0xffffffff81001268, which reside in the kernel's virtual address range. These addresses reveal the runtime location of kernel text and directly bypass KASLR randomization.

Root Cause

The root cause is incomplete software filtering after the hardware LBR filter. The kernel relied on the hardware privilege filter to enforce the PERF_SAMPLE_BRANCH_USER semantics but did not cross-check the branch-from address against br_sel. Because AMD LBR v2 only filters on the target address, kernel-originated branches were passed through unmodified.

Attack Vector

A local, unprivileged process that is permitted to open perf events with branch sampling can request user-only branch records and read kernel addresses from the returned sample stream. No memory corruption is required, and the leak is deterministic given normal syscall activity. The upstream fix extends the software branch filter to validate the branch-from address against br_sel and drops any record whose source lies in kernel space when PERF_SAMPLE_BRANCH_USER is set. Refer to the kernel commit fb3b76b5ad2ebad63dd76f8b65b624eaf638b73f for the patch details.

// No verified exploit code is available for this CVE.
// The condition is triggered by requesting user-only branch
// sampling on AMD LBR v2 hardware and observing kernel
// virtual addresses (0xffffffff........) in branch-from fields.

Detection Methods for CVE-2026-80602

Indicators of Compromise

Unprivileged processes issuing perf_event_open syscalls with PERF_SAMPLE_BRANCH_STACK and the PERF_SAMPLE_BRANCH_USER filter on AMD hosts.
Presence of kernel-range addresses (0xffffffff........) in branch-from fields of user-only branch samples captured by perf script -F brstack.
Non-profiling workloads repeatedly reading branch stack data from perf ring buffers.

Detection Strategies

Audit perf_event_paranoid sysctl values across the fleet and flag hosts where unprivileged users can access branch sampling (kernel.perf_event_paranoid <= 1).
Monitor auditd or eBPF telemetry for perf_event_open calls from non-administrative user IDs on AMD systems.
Correlate CPU vendor and microarchitecture inventory with kernel version to identify unpatched AMD LBR v2 hosts.

Monitoring Recommendations

Track kernel package versions and confirm the patched commits are present on all AMD endpoints and servers.
Alert on anomalous perf ring buffer sizes or long-running unprivileged perf sessions.
Log kernel command-line changes to perf_event_paranoid and unexpected loading of profiling tooling in production.

How to Mitigate CVE-2026-80602

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable git tree and reboot affected AMD systems.
Restrict access to perf branch sampling by setting kernel.perf_event_paranoid to 2 or higher on hosts that do not require unprivileged profiling.
Inventory AMD systems supporting X86_FEATURE_AMD_LBR_V2 and prioritize them for patching.

Patch Information

The fix extends software filtering in the AMD LBR handler to validate branch-from addresses against br_sel and drop kernel-origin entries when PERF_SAMPLE_BRANCH_USER is requested. Relevant stable commits include 208ecca408b1, 2a892294b83f, 5ab0eba9c881, 5be478c1e089, and fb3b76b5ad2e.

Workarounds

Set kernel.perf_event_paranoid=3 to disallow unprivileged users from opening perf events entirely.
Remove the CAP_PERFMON capability from untrusted service accounts and container workloads.
Disable branch sampling in profiling agents that do not require branch stack data until the patched kernel is deployed.

bash

# Restrict unprivileged perf usage until patched
sudo sysctl -w kernel.perf_event_paranoid=3
echo 'kernel.perf_event_paranoid=3' | sudo tee /etc/sysctl.d/99-cve-2026-80602.conf

# Verify current kernel version against patched stable releases
uname -r