CVE-2026-31528

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> perf: Make sure to use pmu_ctx-&gt;pmu for groups<br /> <br /> Oliver reported that x86_pmu_del() ended up doing an out-of-bound memory access<br /> when group_sched_in() fails and needs to roll back.<br /> <br /> This *should* be handled by the transaction callbacks, but he found that when<br /> the group leader is a software event, the transaction handlers of the wrong PMU<br /> are used. Despite the move_group case in perf_event_open() and group_sched_in()<br /> using pmu_ctx-&gt;pmu.<br /> <br /> Turns out, inherit uses event-&gt;pmu to clone the events, effectively undoing the<br /> move_group case for all inherited contexts. Fix this by also making inherit use<br /> pmu_ctx-&gt;pmu, ensuring all inherited counters end up in the same pmu context.<br /> <br /> Similarly, __perf_event_read() should use equally use pmu_ctx-&gt;pmu for the<br /> group case.