CVE-2026-98937

Description

In the Linux kernel, the following vulnerability has been resolved: perf/core: Check kernel access when kernel callchains are requested perf_event_open() currently gates perf_allow_kernel() only on !attr.exclude_kernel. However, users can still request kernel callchain collection with attr.exclude_callchain_kernel == 0 even when attr.exclude_kernel == 1. That still requires kernel profiling privilege, but the existing check does not enforce it. Update the permission check to call perf_allow_kernel() when either kernel sampling is requested or kernel callchains are requested. This keeps permission checks aligned with requested data and prevents unprivileged use of kernel callchain capture.

Is your site exposed to CVE-2026-98937?

Run a free security scan — no signup, results in seconds.

EPSS — Exploit Prediction

0.0029

Probability of exploitation

0.22%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/132bee76097be421ab3012130b5b506324cf2be1 https://git.kernel.org/stable/c/2581b43e162cfc43e6f5d8dd8d2b38f3441550de https://git.kernel.org/stable/c/6e187281f978a2bff98ead6aa40f8ddc9a2c9afb https://git.kernel.org/stable/c/a4573a3838ae4fc73b70019cfa1dac9aaea7cc2f

Frequently Asked Questions

What is CVE-2026-98937? +

In the Linux kernel, the following vulnerability has been resolved: perf/core: Check kernel access when kernel callchains are requested perf_event_open() currently gates perf_allow_kernel() only on !attr.exclude_kernel. However, users can still request kernel callchain collection with attr.exclude_callchain_kernel == 0 even when attr.exclude_kernel == 1. That still requires kernel profiling privilege, but the existing check does not enforce it. Update the permission check to call perf_allow_kernel() when either kernel sampling is requested or kernel callchains are requested. This keeps permission checks aligned with requested data and prevents unprivileged use of kernel callchain capture.

How do I check if I'm vulnerable to CVE-2026-98937? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.