1. Home
  2. Vulnerabilities
  3. CVE-2026-72325
0.0
NA
CVE-2026-72325
perf/x86/amd/core: Avoid enabling BRS from the SVM reload path
Overview
Description

In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd/core: Avoid enabling BRS from the SVM reload path Branch Sampling (BRS) and Last Branch Record (LBR) are mutually exclusive hardware features, and users of both are tracked via cpuc->lbr_users. When SVM is toggled on a CPU, the host perf events are reprogrammed to update the HostOnly filter bit (set when virtualization is enabled, cleared when it is disabled). On PerfMonV2-capable processors, this reprogramming is performed by calling amd_pmu_enable_all() to rewrite the event selectors. However, amd_pmu_enable_all() also calls amd_brs_enable_all(), which enables BRS whenever cpuc->lbr_users > 0. Having active LBR events satisfies this gating on processors that have LBR but not BRS. The kernel then tries to set the BRS enable bit in DebugExtnCfg (MSR 0xc000010f). Since that bit is deprecated on such hardware, the write results in a #GP: Call Trace: <IRQ> amd_pmu_enable_all+0x1d/0x90 amd_pmu_disable_virt+0x62/0xb0 kvm_arch_disable_virtualization_cpu+0xa/0x40 [kvm] hardware_disable_nolock+0x1a/0x30 [kvm] __flush_smp_call_function_queue+0x9b/0x410 __sysvec_call_function+0x18/0xc0 sysvec_call_function+0x69/0x90 </IRQ> <TASK> asm_sysvec_call_function+0x16/0x20 RIP: 0010:cpuidle_enter_state+0xc4/0x450 ? cpuidle_enter_state+0xb7/0x450 cpuidle_enter+0x29/0x40 cpuidle_idle_call+0xf5/0x160 do_idle+0x7b/0xe0 cpu_startup_entry+0x26/0x30 start_secondary+0x115/0x140 secondary_startup_64_no_verify+0x194/0x19b </TASK> Fix this by ensuring that BRS is not enabled from the event selector reprogramming path even when cpuc->lbr_users > 0.

Details
INFO

Published Date :

Aug. 15, 2026, 6:22 a.m.

Last Modified :

Aug. 17, 2026, 6:18 a.m.

Remotely Exploit :

No

Source :

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Impact
Affected Products

The following products are affected by CVE-2026-72325 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Linux linux_kernel
: Total Affected Vendor : 1 | Products : 1
Solution
Apply the Linux kernel patch to prevent BRS enabling during SVM reload.
  • Update the Linux kernel to the latest version.
  • Apply the specific patch for perf/x86/amd/core.
  • Recompile the kernel if necessary.
  • Reboot the system.
References
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2026-72325.

URL Resource
https://git.kernel.org/stable/c/07c60dda9c059c09f83d42a3ebda2e7cc1cf3bc2
https://git.kernel.org/stable/c/46d0fd8535edce31f15e48d2de1bdee39a4850e5
https://git.kernel.org/stable/c/7cc438c99bba324a0562b1bafa747b10f7e251df
https://git.kernel.org/stable/c/e9b1a7411a667539c2f55e720bbb5f623b526a32
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-72325 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-72325 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-72325 vulnerability anywhere in the article.

Results are limited to the first 20 news articles due to potential performance issues.

The following table lists the changes that have been made to the CVE-2026-72325 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Aug. 17, 2026

    Action Type Old Value New Value
    Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'bae19fdd7e9e759580ac4693d2df3bc23ab415d7', 'lessThan': 'e9b1a7411a667539c2f55e720bbb5f623b526a32', 'versionType': 'git'}, {'status': 'affected', 'version': 'bae19fdd7e9e759580ac4693d2df3bc23ab415d7', 'lessThan': '7cc438c99bba324a0562b1bafa747b10f7e251df', 'versionType': 'git'}, {'status': 'affected', 'version': 'bae19fdd7e9e759580ac4693d2df3bc23ab415d7', 'lessThan': '46d0fd8535edce31f15e48d2de1bdee39a4850e5', 'versionType': 'git'}, {'status': 'affected', 'version': 'bae19fdd7e9e759580ac4693d2df3bc23ab415d7', 'lessThan': '07c60dda9c059c09f83d42a3ebda2e7cc1cf3bc2', 'versionType': 'git'}], 'programFiles': ['arch/x86/events/amd/core.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.19'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.19', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc3', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['arch/x86/events/amd/core.c'], 'defaultStatus': 'affected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'bae19fdd7e9e759580ac4693d2df3bc23ab415d7', 'lessThan': 'e9b1a7411a667539c2f55e720bbb5f623b526a32', 'versionType': 'git'}, {'status': 'affected', 'version': 'bae19fdd7e9e759580ac4693d2df3bc23ab415d7', 'lessThan': '7cc438c99bba324a0562b1bafa747b10f7e251df', 'versionType': 'git'}, {'status': 'affected', 'version': 'bae19fdd7e9e759580ac4693d2df3bc23ab415d7', 'lessThan': '46d0fd8535edce31f15e48d2de1bdee39a4850e5', 'versionType': 'git'}, {'status': 'affected', 'version': 'bae19fdd7e9e759580ac4693d2df3bc23ab415d7', 'lessThan': '07c60dda9c059c09f83d42a3ebda2e7cc1cf3bc2', 'versionType': 'git'}], 'programFiles': ['arch/x86/events/amd/core.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.19'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.19', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['arch/x86/events/amd/core.c'], 'defaultStatus': 'affected'}]
  • New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Aug. 15, 2026

    Action Type Old Value New Value
    Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'bae19fdd7e9e759580ac4693d2df3bc23ab415d7', 'lessThan': 'e9b1a7411a667539c2f55e720bbb5f623b526a32', 'versionType': 'git'}, {'status': 'affected', 'version': 'bae19fdd7e9e759580ac4693d2df3bc23ab415d7', 'lessThan': '7cc438c99bba324a0562b1bafa747b10f7e251df', 'versionType': 'git'}, {'status': 'affected', 'version': 'bae19fdd7e9e759580ac4693d2df3bc23ab415d7', 'lessThan': '46d0fd8535edce31f15e48d2de1bdee39a4850e5', 'versionType': 'git'}, {'status': 'affected', 'version': 'bae19fdd7e9e759580ac4693d2df3bc23ab415d7', 'lessThan': '07c60dda9c059c09f83d42a3ebda2e7cc1cf3bc2', 'versionType': 'git'}], 'programFiles': ['arch/x86/events/amd/core.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.19'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.19', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc3', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['arch/x86/events/amd/core.c'], 'defaultStatus': 'affected'}]
    Added Description In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd/core: Avoid enabling BRS from the SVM reload path Branch Sampling (BRS) and Last Branch Record (LBR) are mutually exclusive hardware features, and users of both are tracked via cpuc->lbr_users. When SVM is toggled on a CPU, the host perf events are reprogrammed to update the HostOnly filter bit (set when virtualization is enabled, cleared when it is disabled). On PerfMonV2-capable processors, this reprogramming is performed by calling amd_pmu_enable_all() to rewrite the event selectors. However, amd_pmu_enable_all() also calls amd_brs_enable_all(), which enables BRS whenever cpuc->lbr_users > 0. Having active LBR events satisfies this gating on processors that have LBR but not BRS. The kernel then tries to set the BRS enable bit in DebugExtnCfg (MSR 0xc000010f). Since that bit is deprecated on such hardware, the write results in a #GP: Call Trace: <IRQ> amd_pmu_enable_all+0x1d/0x90 amd_pmu_disable_virt+0x62/0xb0 kvm_arch_disable_virtualization_cpu+0xa/0x40 [kvm] hardware_disable_nolock+0x1a/0x30 [kvm] __flush_smp_call_function_queue+0x9b/0x410 __sysvec_call_function+0x18/0xc0 sysvec_call_function+0x69/0x90 </IRQ> <TASK> asm_sysvec_call_function+0x16/0x20 RIP: 0010:cpuidle_enter_state+0xc4/0x450 ? cpuidle_enter_state+0xb7/0x450 cpuidle_enter+0x29/0x40 cpuidle_idle_call+0xf5/0x160 do_idle+0x7b/0xe0 cpu_startup_entry+0x26/0x30 start_secondary+0x115/0x140 secondary_startup_64_no_verify+0x194/0x19b </TASK> Fix this by ensuring that BRS is not enabled from the event selector reprogramming path even when cpuc->lbr_users > 0.
    Added Reference https://git.kernel.org/stable/c/07c60dda9c059c09f83d42a3ebda2e7cc1cf3bc2
    Added Reference https://git.kernel.org/stable/c/46d0fd8535edce31f15e48d2de1bdee39a4850e5
    Added Reference https://git.kernel.org/stable/c/7cc438c99bba324a0562b1bafa747b10f7e251df
    Added Reference https://git.kernel.org/stable/c/e9b1a7411a667539c2f55e720bbb5f623b526a32
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CVSS
Vulnerability Scoring Details
No CVSS metrics available for this vulnerability.