VulnerabilityPublished 25 Sep 2026Updated 30 Oct 2026

CVE-2026-97587: Linux kernel · perf: RISC-V: store available counter mask as bitmap

Source GCVE Database

Compare

Authoritative record:CVE-2026-97587· Medium

Not known to be exploited · fixed in e5481db31f4654e9a1254d5d467d9b1ff2f8b1cb : update Linux kernel when convenient.

Data as of 30 Oct 2026, 17:33 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Patch: Available – fixed in e5481db31f4654e9a1254d5d467d9b1ff2f8b1cb, 433249a4de52ecda40ffa9c466cec1312e62826f, 143668c424772979a45118dc9cc9c2c13a35f41d +3

Exploitation evidence

Disclosed: evidence found.
CVE published 25 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-5mgm-fggv-mx2j

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ e9991434596f5373dfd75857b445eb92a9253c56, < e5481db31f4654e9a1254d5d467d9b1ff2f8b1cb	Fixed in e5481db31f4654e9a1254d5d467d9b1ff2f8b1cb
LinuxLinux	Affected ≥ e9991434596f5373dfd75857b445eb92a9253c56, < 433249a4de52ecda40ffa9c466cec1312e62826f	Fixed in 433249a4de52ecda40ffa9c466cec1312e62826f
LinuxLinux	Affected ≥ e9991434596f5373dfd75857b445eb92a9253c56, < 143668c424772979a45118dc9cc9c2c13a35f41d	Fixed in 143668c424772979a45118dc9cc9c2c13a35f41d
LinuxLinux	Affected ≥ e9991434596f5373dfd75857b445eb92a9253c56, < 6809da6e9c08ccc9a09cb0a48c61471679274aaa	Fixed in 6809da6e9c08ccc9a09cb0a48c61471679274aaa
LinuxLinux	Affected ≥ e9991434596f5373dfd75857b445eb92a9253c56, < 9bec7beaed074bcae4181fde9ff9dfbe4e7b0957	Fixed in 9bec7beaed074bcae4181fde9ff9dfbe4e7b0957
LinuxLinux	Affected ≥ e9991434596f5373dfd75857b445eb92a9253c56, < 5a1b6379eed5b13eac0228b605b0bed988e547e9	Fixed in 5a1b6379eed5b13eac0228b605b0bed988e547e9

AI-suggested

A fix has been implemented in the Linux kernel source to store the available counter mask as a bitmap and update related logic accordingly. Users should apply the updated kernel version containing this patch once available. No additional mitigation steps are indicated by the vendor advisory.

Description

A vulnerability in the Linux kernel's perf subsystem for RISC-V architectures involved improper handling of the available counter mask, which was stored as a single unsigned long but iterated using a 64-bit maximum counter constant. This caused out-of-bounds reads on 32-bit RISC-V systems. The issue was addressed by changing the mask storage to a bitmap and updating related logic to correctly handle counters beyond 32 bits.

Impact

The vulnerability caused out-of-bounds memory reads in the perf subsystem on 32-bit RISC-V systems, which could lead to undefined behavior or kernel instability. No direct exploit or active exploitation in the wild has been reported. The impact is limited to kernel performance monitoring on affected architectures and does not indicate privilege escalation or code execution.

Summary

The Linux kernel perf subsystem for RISC-V previously stored the available counter mask as a single unsigned long, which is insufficient for the 64 counters defined by RISCV_MAX_COUNTERS. On 32-bit RISC-V systems (RV32), this led to out-of-bounds memory reads and incorrect bit setting for counters with indices 32 and above. The fix involved using DECLARE_BITMAP and bitmap helper functions to properly represent and iterate the available counters as a bitmap, ensuring correct handling of all counters. This change also unified the handling of the CFG_MATCH ecall argument to avoid duplication and addressed issues observed in qemu-system-riscv32 emulation.

References

Community reviews

Loading reviews…