Strix
56.9K

CVE-2026-72236

UnknownEPSS 0.21%

Last modified

CVE-2026-72236 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() ev variable is userspace controlled via event->attr.config and used as an array index after bounds checking, but without speculation barriers. Add the missing array_index_nospec() call to prevent speculative execution.. EPSS estimates a 0.21% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() ev variable is userspace controlled via event->attr.config and used as an array index after bounds checking, but without speculation barriers. Add the missing array_index_nospec() call to prevent speculative execution.

Metrics

EPSS Probability
0.21%

12.3th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 212188a596d17d519842ef2173150315735b54e1, < 27206bb57c47bdbe33bccc78fa7f7e2a719a06b9; >= 212188a596d17d519842ef2173150315735b54e1, < a21f3615c88421df81060b6ff89220fd34094c4d; >= 212188a596d17d519842ef2173150315735b54e1, < fa1ebae4206e6afc8caa642e9eb1bbe39a9a724f; >= 212188a596d17d519842ef2173150315735b54e1, < f79dff8c721bbb1f3fc312ea55e0551c2cc28801; >= 212188a596d17d519842ef2173150315735b54e1, < 49145bce539117db4b6e9e83c0e5ef528e361050
LinuxLinux3.4

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-72236?
In the Linux kernel, the following vulnerability has been resolved: s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() ev variable is userspace controlled via event->attr.config and used as an array index after bounds checking, but without speculation barriers. Add the missing array_index_nospec() call to prevent speculative execution.
How severe is CVE-2026-72236?
Severity scoring for CVE-2026-72236 is pending analysis. The EPSS model estimates a 0.21% probability of exploitation in the next 30 days.
How do I fix CVE-2026-72236?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-72236?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST