Linux Kernel up to 7.2.12 s390 pai pai_have_samples iteration

Summaryinfo

A vulnerability labeled as very critical has been found in Linux Kernel up to 7.2.12. This affects the function pai_have_samples of the component s390 pai. Executing a manipulation can lead to iteration. The identification of this vulnerability is CVE-2026-99125. The attack can only be executed locally. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability has been found in Linux Kernel up to 7.2.12 and classified as very critical. This vulnerability affects the function pai_have_samples of the component s390 pai. The manipulation with an unknown input leads to a iteration vulnerability. The CWE definition for the vulnerability is CWE-834. The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: s390/pai: Handle multiple PMU stop callback invocations Handle the following scenario: The kernel protects itself against a very high sampling load and throttles the sampling using: perf_event_throttle() --> PMU->stop() Shortly later the scheduler may terminate the task and removes it from the CPU. It again calls PMU->stop() which results in two invocations of PMU->stop() called back to back. Protect against this and check the PERF_HES_STOPPED bit on function entry. If it is already set return. Clear bit PERF_HES_STOPPED in PMU->start(). Prohibit ioctl(fd, PERF_EVENT_IOC_PERIOD, ...) call for this event. It sets perf_event::event_limit to a positive value and causes perf_event_overflow() to invoke pai_stop() call back function when perf_event::event_limit hits zero. This is not supported because the sample events CRYPTO_ALL and NNPA_ALL are only taken at schedule out of a task. Use list_for_each_entry_safe() for safe iteration over syswide_list in pai_have_samples().

The advisory is shared for download at git.kernel.org. This vulnerability was named CVE-2026-99125 since 09/25/2026. The exploitation appears to be easy. The attack needs to be approached locally. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 10/28/2026).

Upgrading to version 7.2.13 eliminates this vulnerability. Applying the patch cf348ec613f75b9774291e47b804fd7010835a6c/f3110e969ad226ffbb2d9b4bf5387e68d0d9ef40 is able to eliminate this problem. The best possible mitigation is suggested to be upgrading to the latest version.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.2.0
• 7.2.1
• 7.2.2
• 7.2.3
• 7.2.4
• 7.2.5
• 7.2.6
• 7.2.7
• 7.2.8
• 7.2.9
• 7.2.10
• 7.2.11
• 7.2.12

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion