CVE-2026-72236

Not scored yetLast modified Aug 23, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init()

ev variable is userspace controlled via event->attr.config and used as an array index after bounds checking, but without speculation barriers.

Add the missing array_index_nospec() call to prevent speculative execution.

Metrics

No CVSS score has been published yet.

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 212188a596d17d519842ef2173150315735b54e1, < 4c249b214c686f9a1c4cf4f32893b59b189e897a; >= 212188a596d17d519842ef2173150315735b54e1, < 27206bb57c47bdbe33bccc78fa7f7e2a719a06b9; >= 212188a596d17d519842ef2173150315735b54e1, < a21f3615c88421df81060b6ff89220fd34094c4d; >= 212188a596d17d519842ef2173150315735b54e1, < fa1ebae4206e6afc8caa642e9eb1bbe39a9a724f; >= 212188a596d17d519842ef2173150315735b54e1, < f79dff8c721bbb1f3fc312ea55e0551c2cc28801; >= 212188a596d17d519842ef2173150315735b54e1, < 49145bce539117db4b6e9e83c0e5ef528e361050
LinuxLinux3.4

References

Timeline

Published
Aug 15, 2026
Last modified
Aug 23, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-72237In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd/brs: Fix kernel address leakage A user-only branch stack CVE-2026-72238In the Linux kernel, the following vulnerability has been resolved: x86/boot: Validate console=uart8250 baud rate to fix early boot hang WCVE-2026-722399.3In the Linux kernel, the following vulnerability has been resolved: x86/virt/sev: Revert "Drop WBINVD before setting MSR_AMD64_SYSCFG_SNP_ECVE-2026-72247.3A security flaw has been discovered in SourceCodester Pizzafy Ecommerce System 1.0. This affects the function delete_cart of the file /adminCVE-2026-72240In the Linux kernel, the following vulnerability has been resolved: mfd: sm501: Fix reference leak on failed device registration When platCVE-2026-72241In the Linux kernel, the following vulnerability has been resolved: leds: uleds: Fix potential buffer overread The name string supplied byCVE-2026-722427.5In the Linux kernel, the following vulnerability has been resolved: selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() seCVE-2026-722438.4In the Linux kernel, the following vulnerability has been resolved: selinux: check connect-related permissions on TCP Fast Open Similar toCVE-2026-722447.8In the Linux kernel, the following vulnerability has been resolved: gpu/buddy: bail out of try_harder when alignment cannot be honoured ThCVE-2026-72245In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix device reference leak in host1x_device_parse_dt() erroCVE-2026-722477.5In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conncount: fix zone comparison in tuple dedup The "alreaCVE-2026-722489.8In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: support IPIP tunnel with direct xmit The combina
CVE-2026-72236: Unscored | Vulnix