---
id: CVE-2026-98937
title: 'perf/core: Check kernel access when kernel callchains are requested'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  perf/core: Check kernel access when kernel callchains are requested

  perf_event_open() currently gates perf_allow_kernel() only on
  !attr.exclude_kernel.

  However, users…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    132bee76097be421ab3012130b5b506324cf2be1
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    2581b43e162cfc43e6f5d8dd8d2b38f3441550de
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    6e187281f978a2bff98ead6aa40f8ddc9a2c9afb
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    a4573a3838ae4fc73b70019cfa1dac9aaea7cc2f
  - Linux < 6.12.113
  - Linux < 6.18.56
  - Linux < 7.2.10
  - Linux (all versions)
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T12:11:53.327Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98937'
references:
  - url: 'https://git.kernel.org/stable/c/132bee76097be421ab3012130b5b506324cf2be1'
  - url: 'https://git.kernel.org/stable/c/2581b43e162cfc43e6f5d8dd8d2b38f3441550de'
  - url: 'https://git.kernel.org/stable/c/6e187281f978a2bff98ead6aa40f8ddc9a2c9afb'
  - url: 'https://git.kernel.org/stable/c/a4573a3838ae4fc73b70019cfa1dac9aaea7cc2f'
tags:
  - cve.org
ingestedAt: '2026-10-23T13:24:55.562Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

perf/core: Check kernel access when kernel callchains are requested

perf_event_open() currently gates perf_allow_kernel() only on
!attr.exclude_kernel.

However, users can still request kernel callchain collection with
attr.exclude_callchain_kernel == 0 even when attr.exclude_kernel == 1.
That still requires kernel profiling privilege, but the existing check
does not enforce it.

Update the permission check to call perf_allow_kernel() when either
kernel sampling is requested or kernel callchains are requested.

This keeps permission checks aligned with requested data and prevents
unprivileged use of kernel callchain capture.

## Affected

- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 132bee76097be421ab3012130b5b506324cf2be1`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 2581b43e162cfc43e6f5d8dd8d2b38f3441550de`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 6e187281f978a2bff98ead6aa40f8ddc9a2c9afb`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < a4573a3838ae4fc73b70019cfa1dac9aaea7cc2f`
- `Linux < 6.12.113`
- `Linux < 6.18.56`
- `Linux < 7.2.10`
- `Linux (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.