---
id: CVE-2026-98937
title: 'perf/core: Check kernel access when kernel callchains are requested'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  perf/core: Check kernel access when kernel callchains are requested

  perf_event_open() currently gates perf_allow_kernel() only on
  !attr.exclude_kernel.

  However, users…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 0764771dab80d7b84b9a271bee7f1b21a04a3f0c <
    132bee76097be421ab3012130b5b506324cf2be1
  - >-
    Linux >= 0764771dab80d7b84b9a271bee7f1b21a04a3f0c <
    2581b43e162cfc43e6f5d8dd8d2b38f3441550de
  - >-
    Linux >= 0764771dab80d7b84b9a271bee7f1b21a04a3f0c <
    6e187281f978a2bff98ead6aa40f8ddc9a2c9afb
  - >-
    Linux >= 0764771dab80d7b84b9a271bee7f1b21a04a3f0c <
    a4573a3838ae4fc73b70019cfa1dac9aaea7cc2f
  - Linux 2.6.31
published: '2026-10-23'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T06:56:51.396Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98937'
references:
  - url: 'https://git.kernel.org/stable/c/132bee76097be421ab3012130b5b506324cf2be1'
  - url: 'https://git.kernel.org/stable/c/2581b43e162cfc43e6f5d8dd8d2b38f3441550de'
  - url: 'https://git.kernel.org/stable/c/6e187281f978a2bff98ead6aa40f8ddc9a2c9afb'
  - url: 'https://git.kernel.org/stable/c/a4573a3838ae4fc73b70019cfa1dac9aaea7cc2f'
tags:
  - cve.org
epss: 0.00168
epssPercentile: 0.06153
ingestedAt: '2026-10-23T13:24:55.562Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

perf/core: Check kernel access when kernel callchains are requested

perf_event_open() currently gates perf_allow_kernel() only on
!attr.exclude_kernel.

However, users can still request kernel callchain collection with
attr.exclude_callchain_kernel == 0 even when attr.exclude_kernel == 1.
That still requires kernel profiling privilege, but the existing check
does not enforce it.

Update the permission check to call perf_allow_kernel() when either
kernel sampling is requested or kernel callchains are requested.

This keeps permission checks aligned with requested data and prevents
unprivileged use of kernel callchain capture.

## Affected

- `Linux >= 0764771dab80d7b84b9a271bee7f1b21a04a3f0c < 132bee76097be421ab3012130b5b506324cf2be1`
- `Linux >= 0764771dab80d7b84b9a271bee7f1b21a04a3f0c < 2581b43e162cfc43e6f5d8dd8d2b38f3441550de`
- `Linux >= 0764771dab80d7b84b9a271bee7f1b21a04a3f0c < 6e187281f978a2bff98ead6aa40f8ddc9a2c9afb`
- `Linux >= 0764771dab80d7b84b9a271bee7f1b21a04a3f0c < a4573a3838ae4fc73b70019cfa1dac9aaea7cc2f`
- `Linux 2.6.31`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.