---
id: CVE-2026-99125
title: 's390/pai: Handle multiple PMU stop callback invocations'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  s390/pai: Handle multiple PMU stop callback invocations

  Handle the following scenario:
  The kernel protects itself against a very high sampling load and
  throttles the s…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 9f66572f2889a5e72a9d7e17787e52f03b1f7bd8 <
    cf348ec613f75b9774291e47b804fd7010835a6c
  - >-
    Linux >= 9f66572f2889a5e72a9d7e17787e52f03b1f7bd8 <
    f3110e969ad226ffbb2d9b4bf5387e68d0d9ef40
  - Linux 6.11
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T10:34:40.025Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-99125'
references:
  - url: 'https://git.kernel.org/stable/c/cf348ec613f75b9774291e47b804fd7010835a6c'
  - url: 'https://git.kernel.org/stable/c/f3110e969ad226ffbb2d9b4bf5387e68d0d9ef40'
tags:
  - cve.org
ingestedAt: '2026-10-28T11:09:40.443Z'
epss: 0.00156
epssPercentile: 0.04773
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

s390/pai: Handle multiple PMU stop callback invocations

Handle the following scenario:
The kernel protects itself against a very high sampling load and
throttles the sampling using:

  perf_event_throttle() --> PMU->stop()

Shortly later the scheduler may terminate the task and removes it from the
CPU. It again calls

  PMU->stop()

which results in two invocations of PMU->stop() called back to back.
Protect against this and check the PERF_HES_STOPPED bit on function
entry.  If it is already set return.
Clear bit PERF_HES_STOPPED in PMU->start().

Prohibit ioctl(fd, PERF_EVENT_IOC_PERIOD, ...) call for this event.
It sets perf_event::event_limit to a positive value and causes
perf_event_overflow() to invoke pai_stop() call back function when
perf_event::event_limit hits zero. This is not supported because the
sample events CRYPTO_ALL and NNPA_ALL are only taken at schedule out
of a task.

Use list_for_each_entry_safe() for safe iteration over syswide_list
in pai_have_samples().

## Affected

- `Linux >= 9f66572f2889a5e72a9d7e17787e52f03b1f7bd8 < cf348ec613f75b9774291e47b804fd7010835a6c`
- `Linux >= 9f66572f2889a5e72a9d7e17787e52f03b1f7bd8 < f3110e969ad226ffbb2d9b4bf5387e68d0d9ef40`
- `Linux 6.11`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.