In the Linux kernel, the following vulnerability has been resolved: perf/core: Check kernel access when kernel callchains are requested… (CVE-2026-98937)

The Linux kernel's perf_event_open() function previously enforced permission checks for kernel profiling only when kernel sampling was requested (attr.exclude_kernel == 0). However, users could still request kernel callchain collection (attr.exclude_callchain_kernel == 0) even if kernel sampling was excluded (attr.exclude_kernel == 1), bypassing the intended permission check. This vulnerability allowed users with kernel profiling privileges to collect kernel callchain data without proper enforcement of permissions. The fix updates the permission check to call perf_allow_kernel() when either kernel sampling or kernel callchains are requested, aligning permission enforcement with the requested data and preventing unprivileged kernel callchain capture.

Unprivileged users with kernel profiling privileges could bypass permission checks to collect kernel callchain data, potentially exposing sensitive kernel execution information. This could aid in further attacks or information disclosure within the kernel environment. The vulnerability affects the integrity of kernel profiling access controls.

A fix has been implemented in the Linux kernel to update the permission checks for kernel callchain requests. Users should apply the official kernel update that includes this fix to ensure proper enforcement of kernel profiling privileges. Patch status is not explicitly stated in the provided data; therefore, check the vendor advisory for current remediation guidance.