Answer in brief
CVE-2026-72237 records a Unknown severity vulnerability in perf/x86/amd/brs: Fix kernel address leakage. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=8910075d61a37e5b0d82e6c83ed9a0a31fe9ea08 <ac44b4a3d6137489f8fa2e794b12e849c6b22eaa || >=8910075d61a37e5b0d82e6c83ed9a0a31fe9ea08 <90843d00dbc61220b66408ea0d8775cae9e51f70 || >=8910075d61a37e5b0d82e6c83ed9a0a31fe9ea08 <046f6244da9b68e463a849b21446b9424e531491 || >=8910075d61a37e5b0d82e6c83ed9a0a31fe9ea08 <2e706be56f418718bb3ae66c0aa94f9b61150e6d || >=8910075d61a37e5b0d82e6c83ed9a0a31fe9ea08 <47915e855fb38b42133e31ba917d99565f862154 | ac44b4a3d6137489f8fa2e794b12e849c6b22eaa, 90843d00dbc61220b66408ea0d8775cae9e51f70, 046f6244da9b68e463a849b21446b9424e531491, 2e706be56f418718bb3ae66c0aa94f9b61150e6d, 47915e855fb38b42133e31ba917d99565f862154 |
| Linux/Linuxgeneric | 5.19 | Not reported |
Published upstream
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 15, 2026
In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd/brs: Fix kernel address leakage A user-only branch stack can contain branches that originate from the kernel. As a result, kernel addresses are exposed to user space even when PERF_SAMPLE_BRANCH_USER is requested. On AMD processors supporting X86_FEATURE_BRS (Zen 3 only), perf can still report entries such as SYSRET/interrupt returns for which the branch-from addresses are in the kernel. E.g. $ perf record -j any,u -c 4000 -e branch-brs -o - -- \ perf bench syscall basic --loop 1000 | \ perf script -i - -F brstack|tr ' ' '\n'| \ grep -E '0x[89a-f][0-9a-f]{15}' ... 0xffffffff810001c4/0x72e2e32955eb/-/-/-/0//- 0xffffffff810001c4/0x72e2d94a9821/-/-/-/0//- 0xffffffff810001c4/0x72e2d94ffa1b/-/-/-/0//- ... BRS provides no hardware branch filtering, so privilege level filtering is performed entirely in software. However, amd_brs_match_plm() only validates the branch-to address against the requested privilege levels. For branches from the kernel to user space, the branch-from address is left unchecked and is leaked. Extend the software filter to also validate the branch-from address, so that any branch record whose branch-from address is in the kernel is dropped when PERF_SAMPLE_BRANCH_USER is requested.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-72237 records a Unknown severity vulnerability in perf/x86/amd/brs: Fix kernel address leakage. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=8910075d61a37e5b0d82e6c83ed9a0a31fe9ea08 <ac44b4a3d6137489f8fa2e794b12e849c6b22eaa || >=8910075d61a37e5b0d82e6c83ed9a0a31fe9ea08 <90843d00dbc61220b66408ea0d8775cae9e51f70 || >=8910075d61a37e5b0d82e6c83ed9a0a31fe9ea08 <046f6244da9b68e463a849b21446b9424e531491 || >=8910075d61a37e5b0d82e6c83ed9a0a31fe9ea08 <2e706be56f418718bb3ae66c0aa94f9b61150e6d || >=8910075d61a37e5b0d82e6c83ed9a0a31fe9ea08 <47915e855fb38b42133e31ba917d99565f862154 | ac44b4a3d6137489f8fa2e794b12e849c6b22eaa, 90843d00dbc61220b66408ea0d8775cae9e51f70, 046f6244da9b68e463a849b21446b9424e531491, 2e706be56f418718bb3ae66c0aa94f9b61150e6d, 47915e855fb38b42133e31ba917d99565f862154 |
| Linux/Linuxgeneric | 5.19 | Not reported |
Published upstream
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 15, 2026
In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd/brs: Fix kernel address leakage A user-only branch stack can contain branches that originate from the kernel. As a result, kernel addresses are exposed to user space even when PERF_SAMPLE_BRANCH_USER is requested. On AMD processors supporting X86_FEATURE_BRS (Zen 3 only), perf can still report entries such as SYSRET/interrupt returns for which the branch-from addresses are in the kernel. E.g. $ perf record -j any,u -c 4000 -e branch-brs -o - -- \ perf bench syscall basic --loop 1000 | \ perf script -i - -F brstack|tr ' ' '\n'| \ grep -E '0x[89a-f][0-9a-f]{15}' ... 0xffffffff810001c4/0x72e2e32955eb/-/-/-/0//- 0xffffffff810001c4/0x72e2d94a9821/-/-/-/0//- 0xffffffff810001c4/0x72e2d94ffa1b/-/-/-/0//- ... BRS provides no hardware branch filtering, so privilege level filtering is performed entirely in software. However, amd_brs_match_plm() only validates the branch-to address against the requested privilege levels. For branches from the kernel to user space, the branch-from address is left unchecked and is leaked. Extend the software filter to also validate the branch-from address, so that any branch record whose branch-from address is in the kernel is dropped when PERF_SAMPLE_BRANCH_USER is requested.
Quoted source text, attributed separately from HOL analysis.