CVE-2026-97960

A moderate concurrency flaw was found in the Linux kernel's Intel Performance Monitoring Unit (PMU) implementation. The Precise Event-Based Sampling (PEBS) buffer is shared by all events on a CPU, so the drain_pebs() routine must not be re-entered; however, drain_pebs() is also reachable from process context via intel_pmu_drain_pebs_buffer(), and because disabling a single counter does not stop other active counters from raising a performance monitoring interrupt, an in-flight drain can be interrupted and re-entered. A local user able to configure performance events could exploit this race so that the re-entered drain observes stale buffer state and performs an out-of-bounds memory access, most likely resulting in a denial of service (system crash). Affected products include Red Hat Enterprise Linux 9 (streams from 9.4 onward), Red Hat Enterprise Linux 10, Red Hat In-Vehicle OS 2, and OpenShift Container Platform releases shipping the RHEL 9 based CoreOS kernel, because the vulnerable code was introduced by a PEBS change first included in RHEL 9.4. Red Hat Enterprise Linux 6, 7, 8, and 9.2, and OpenShift Container Platform releases based on RHEL CoreOS 8, are not affected because the vulnerable code is not present. Red Hat rated the impact as Moderate (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because exploitation requires local access to the performance events subsystem and the demonstrated impact is denial of service rather than privilege escalation or data disclosure. A fix is currently deferred for the affected streams; the residual risk is that a local user with access to the perf subsystem could trigger a kernel crash.