CVE-2026-89984: Linux Kernel LBR Information Disclosure

CVE-2026-89984 Overview

CVE-2026-89984 is an information disclosure vulnerability in the Linux kernel's Intel performance monitoring subsystem. The flaw resides in the Last Branch Record (LBR) stack handling within perf/x86/intel. Before Architectural LBR gained Current Privilege Level (CPL) filtering support, user-only branch stacks could still contain kernel addresses. The intel_pmu_lbr_filter() function fails to fully validate the privilege level of sampled entries, allowing kernel branch records to be exposed to user space even when PERF_SAMPLE_BRANCH_USER is requested. On affected processors such as Intel Tiger Lake, unprivileged users can observe kernel-space SYSRET and ERET entries through the perf tool, defeating Kernel Address Space Layout Randomization (KASLR).

Critical Impact
Local unprivileged users can leak kernel virtual addresses through LBR sampling, undermining KASLR and facilitating further kernel exploitation.

Affected Products

Linux kernel with Intel LBR support prior to the fix commits
Intel processors including Tiger Lake generation that expose LBR without CPL filtering
Systems where perf_event_paranoid allows user-mode branch sampling

Discovery Timeline

2026-09-16 - CVE-2026-89984 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89984

Vulnerability Analysis

The vulnerability affects the Intel LBR stack processing code path in the Linux performance monitoring subsystem. LBR is a hardware feature that records the source and destination of recent branch instructions in a rotating stack of model-specific registers. When a user requests branch sampling with the PERF_SAMPLE_BRANCH_USER filter, the kernel is expected to return only user-space branch entries. Before Architectural LBR added hardware CPL filtering, the kernel had to filter entries in software. The existing software filter in intel_pmu_lbr_filter() validates entries based on branch type and destination address, but omits validation of the source (from) address against the requested privilege filter. Certain transitions such as SYSRET and ERET retain kernel from addresses that leak through the filter.

Root Cause

The root cause is incomplete software validation of LBR entries against the branch selector (br_sel). The filter logic in intel_pmu_lbr_filter() inspects branch type metadata and the destination address to decide whether to drop an entry. Entries where the from address is a kernel virtual address but the to address is user-space, such as those produced by SYSRET returning from a syscall or ERET returning from an exception, satisfy the destination check and pass through. This constitutes an information exposure [CWE-200] where privileged kernel state leaks across the user/kernel boundary.

Attack Vector

An unprivileged local attacker uses the perf interface to record branch samples with a user-only filter, then parses the captured branch stack to extract kernel addresses. The reference reproducer runs perf record -e cycles:p --branch-filter any,save_type,u against a workload that performs system calls and grep for entries beginning with the kernel canonical prefix. The leaked addresses reveal the kernel text base, defeating KASLR and enabling reliable targeting for subsequent kernel exploits.

No synthetic exploit code is included. Refer to the upstream fix commits for the exact filter logic. See Linux kernel commit 3c492c8eba02 and Linux kernel commit 68c4b780b266 for the reference implementations.

Detection Methods for CVE-2026-89984

Indicators of Compromise

Unprivileged user processes invoking perf_event_open with PERF_SAMPLE_BRANCH_USER and save_type on Intel systems lacking Arch LBR CPL filtering.
Presence of kernel canonical addresses (matching 0x[89a-f][0-9a-f]{15}) within recorded user-only branch stacks.
Repeated perf record invocations against short syscall-heavy workloads originating from non-administrative accounts.

Detection Strategies

Audit perf_event_paranoid sysctl values; a setting below 2 broadens the exposure surface for LBR sampling.
Monitor process execution telemetry for the perf binary or direct perf_event_open syscalls from unexpected users or containers.
Correlate branch-sampling activity with subsequent process behavior consistent with kernel exploitation reconnaissance.

Monitoring Recommendations

Enable Linux auditd rules for perf_event_open syscalls invoked with branch-sample attributes.
Track kernel version inventory to identify hosts running unpatched perf/x86/intel LBR code.
Alert on non-root processes reading /proc/kallsyms or performing pattern searches against perf.data files.

How to Mitigate CVE-2026-89984

Immediate Actions Required

Apply the upstream kernel patches referenced in the NVD entry to all affected Linux hosts.
Set kernel.perf_event_paranoid=3 where compatible to restrict unprivileged access to perf_event_open.
Restrict container and workload capabilities so unprivileged users cannot invoke branch-record sampling.

Patch Information

The fix extends software filtering in intel_pmu_lbr_filter() to validate both the from and to addresses of each LBR entry against br_sel. Any entry containing a kernel address that does not match the requested user filter is dropped. Patched commits are available across stable branches: 3c492c8eba02, 68c4b780b266, 6ac26161db27, b589147f54ad, be0628a101ac, ca19a175e89b, e2b0575900ff, and f3705db4e637.

Workarounds

Disable unprivileged access to performance events by setting kernel.perf_event_paranoid=3.
Remove CAP_PERFMON and CAP_SYS_ADMIN from workloads that do not require performance profiling.
Where feasible, disable LBR sampling for untrusted tenants via cgroup or seccomp policy until patched kernels are deployed.

bash

# Configuration example: restrict unprivileged perf usage
sudo sysctl -w kernel.perf_event_paranoid=3
echo 'kernel.perf_event_paranoid=3' | sudo tee /etc/sysctl.d/10-perf-restrict.conf
sudo sysctl --system