CVE-2026-89460: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-89460 Overview

CVE-2026-89460 is a Linux kernel vulnerability in the s390 architecture's CPU Measurement Facility (cpum_cf) subsystem. The flaw causes a kernel panic when CPUs are hot-plugged during a perf stat session that measures per-task events. The root cause is a null pointer dereference [CWE-476] in cpumf_pmu_add() when the scheduler moves a task onto a CPU that was offline at the time the perf event was created. Kernel maintainers resolved the issue by introducing CPU hotplug prepare/dead callbacks that create and remove per-CPU counter data even when the CPU is offline.

Critical Impact
A local, unprivileged user running perf stat against a workload can panic the kernel on s390 systems that undergo CPU hotplug during the measurement window, causing a denial of service.

Affected Products

Linux kernel on IBM s390/s390x architecture with CPU Measurement Facility support
Kernel builds prior to the commits referenced in the stable tree fixes
Environments performing runtime CPU hotplug operations while perf or /dev/hwctr sessions are active

Discovery Timeline

2026-09-11 - CVE-2026-89460 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89460

Vulnerability Analysis

The vulnerability lives in the s390 CPU Measurement Facility counter driver (arch/s390/kernel/perf_cpum_cf.c). The driver dynamically allocates struct cpu_cf_events when the first perf event is initialized. That allocation only covers CPUs that are online at the moment the event is created. Any CPU brought online later has no per-CPU counter infrastructure.

When the scheduler dispatches a task-context perf event onto such a newly onlined CPU, cpumf_pmu_add() calls this_cpu_cfhw(), which returns NULL. The subsequent dereference triggers a kernel pointer fault in virtual kernel address space and panics the system. The failing PSW recorded in the backtrace points at cpumf_pmu_add+0x3c/0x80.

Root Cause

The root cause is missing CPU hotplug lifecycle handling for per-CPU perf counter state. The subsystem assumed a static CPU topology at event-open time and did not register cpuhp prepare or dead callbacks. When a CPU transitions from offline to online during a running measurement, the required struct cpu_cf_events is absent, and the PMU callbacks operate on a stale or NULL this_cpu_cfhw() pointer.

Attack Vector

Exploitation requires local access with the ability to invoke perf_event_open() in task context or open /dev/hwctr, plus the ability or timing to trigger CPU hotplug. A reproducer combines perf stat -e cycles -i -- <workload> with echo 1 > /sys/devices/system/cpu/cpuN/online while the workload is scheduled. When the scheduler places the task on the newly onlined CPU, the NULL dereference occurs and the kernel panics, producing a denial-of-service condition. No remote vector exists, and no privilege escalation or code execution has been reported.

See the upstream fix commits for the full patch details: Kernel Patch 337bd95, Kernel Patch 71d46de, Kernel Patch 777d040, Kernel Patch 991be92, and Kernel Patch dcce7a0.

Detection Methods for CVE-2026-89460

Indicators of Compromise

Kernel panic entries in dmesg or /var/log/messages referencing cpumf_pmu_add+0x3c/0x80 with a failing address of 0000000000000000.
Last Breaking-Event-Address pointing to this_cpu_cfhw+0x38/0x40 in the crash trace.
Unexpected system reboots on s390/s390x hosts running perf stat or userspace consumers of /dev/hwctr during CPU hotplug operations.

Detection Strategies

Inventory s390 Linux systems and compare running kernel versions against the fixed stable-tree commits listed in the references.
Correlate perf_event_open syscall activity with cpuhp state transitions in audit or tracing data to flag conditions that match the crash pattern.
Monitor for kernel oops signatures containing cpum_cf symbols in centralized log pipelines.

Monitoring Recommendations

Forward kernel.crit and kernel.emerg syslog facility messages from s390 hosts to a central logging platform for review.
Alert on any write to /sys/devices/system/cpu/cpu*/online that occurs while perf measurement processes are active.
Track host availability and unexpected reboots on mainframe Linux guests to identify possible triggers.

How to Mitigate CVE-2026-89460

Immediate Actions Required

Apply the upstream Linux kernel patches for s390 cpum_cf referenced in the NVD entry and reboot affected hosts.
Restrict use of perf_event_open() by setting kernel.perf_event_paranoid to a restrictive value where operationally acceptable.
Restrict permissions on /dev/hwctr to trusted administrative users only.
Avoid concurrent CPU hotplug operations while performance measurement sessions are active until patches are deployed.

Patch Information

The fix introduces a CPU hotplug prepare/dead callback pair that allocates and frees per-CPU counter state independently of CPU online status. It also adds a cpu_cf_root::tskcnt counter protected by pmc_reserve_mutex to track task-context users, and clears reference pointers to NULL before freeing data to prevent interrupt handlers from touching stale memory. Distributions shipping s390 kernels should backport the stable-tree commits: 337bd95, 71d46de, 777d040, 991be92, and dcce7a0.

Workarounds

Disable dynamic CPU hotplug on production s390 guests until the kernel is patched.
Set kernel.perf_event_paranoid=3 via sysctl to block unprivileged perf_event_open() calls.
Revoke read/write access to /dev/hwctr for non-administrative accounts.

bash

# Configuration example: harden perf and hwctr access pending patch deployment
sysctl -w kernel.perf_event_paranoid=3
echo 'kernel.perf_event_paranoid=3' >> /etc/sysctl.d/99-cve-2026-89460.conf
chmod 600 /dev/hwctr
chown root:root /dev/hwctr