In the Linux kernel, the following vulnerability has been resolved:

s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init()

ev variable is userspace controlled via event->attr.config and used
as an array index after bounds checking, but without speculation
barriers.

Add the missing array_index_nospec() call to prevent speculative
execution.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00225.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
212188a596d17d519842ef2173150315735b54e1 affected < 27206bb57c47bdbe33bccc78fa7f7e2a719a06b9
212188a596d17d519842ef2173150315735b54e1 affected < a21f3615c88421df81060b6ff89220fd34094c4d
212188a596d17d519842ef2173150315735b54e1 affected < fa1ebae4206e6afc8caa642e9eb1bbe39a9a724f
212188a596d17d519842ef2173150315735b54e1 affected < f79dff8c721bbb1f3fc312ea55e0551c2cc28801
212188a596d17d519842ef2173150315735b54e1 affected < 49145bce539117db4b6e9e83c0e5ef528e361050
Linux Linux affected
Version Status Constraints
3.4 affected —
0 unaffected < 3.4
6.6.145 unaffected ≤ 6.6.*
6.12.97 unaffected ≤ 6.12.*
6.18.40 unaffected ≤ 6.18.*
7.1.5 unaffected ≤ 7.1.*
7.2-rc4 unaffected ≤ *

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/27206bb57c47bdbe33bccc78fa7f7e2a719a06b9 cve-icon cve-icon
https://git.kernel.org/stable/c/49145bce539117db4b6e9e83c0e5ef528e361050 cve-icon cve-icon
https://git.kernel.org/stable/c/a21f3615c88421df81060b6ff89220fd34094c4d cve-icon cve-icon
https://git.kernel.org/stable/c/f79dff8c721bbb1f3fc312ea55e0551c2cc28801 cve-icon cve-icon
https://git.kernel.org/stable/c/fa1ebae4206e6afc8caa642e9eb1bbe39a9a724f cve-icon cve-icon
History

Sat, 15 Aug 2026 06:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() ev variable is userspace controlled via event->attr.config and used as an array index after bounds checking, but without speculation barriers. Add the missing array_index_nospec() call to prevent speculative execution.
Title s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-15T05:54:25.891Z

Reserved: 2026-08-09T03:40:39.914Z

Link: CVE-2026-72236

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-15T06:21:50.633

Modified: 2026-08-15T06:21:50.633

Link: CVE-2026-72236

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-15T10:30:05Z

Weaknesses

No weakness.