In the Linux kernel, the following vulnerability has been resolved: s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks The command 'perf… (CVE-2026-89460)
A vulnerability in the Linux kernel's s390 architecture perf subsystem was resolved. The issue caused kernel crashes when CPUs were hotplugged (added or removed) during the execution of perf commands with task context. The root cause was improper handling of per-CPU event structures when CPUs were offline during event initialization but brought online during runtime, leading to NULL pointer dereferences and kernel panics. The fix introduces CPU hotplug callbacks to properly create and remove per-CPU counter data, ensuring stability when CPUs change state during perf runs.
AI Analysis
Technical Summary
The Linux kernel vulnerability (CVE-2026-89460) affects the s390 architecture's perf subsystem. When CPUs are hotplugged online during a perf stat command running with task context, the kernel crashes due to a NULL pointer dereference. This occurs because the per-CPU event infrastructure is only allocated for CPUs online at event initialization, leaving newly online CPUs without initialized structures. When the scheduler runs the monitored task on such a CPU, the perf subsystem dereferences a NULL pointer, causing a kernel panic. The fix adds CPU hotplug prepare/dead callbacks to allocate and free per-CPU event data dynamically as CPUs go offline or come online, preventing the NULL pointer dereference.
Potential Impact
The vulnerability causes kernel panics (crashes) on s390 systems running perf commands with task context when CPUs are hotplugged online during execution. This can lead to denial of service due to kernel instability. There is no indication of privilege escalation or data corruption beyond the crash. The issue is specific to the s390 architecture and the perf subsystem's handling of CPU hotplug events.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to handle CPU hotplug events properly in the s390 perf subsystem by introducing prepare/dead callbacks that manage per-CPU event data lifecycle. Users should update to a kernel version that includes this fix. No additional mitigation is required once the patch is applied.
In the Linux kernel, the following vulnerability has been resolved: s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks The command 'perf… (CVE-2026-89460)
Description
A vulnerability in the Linux kernel's s390 architecture perf subsystem was resolved. The issue caused kernel crashes when CPUs were hotplugged (added or removed) during the execution of perf commands with task context. The root cause was improper handling of per-CPU event structures when CPUs were offline during event initialization but brought online during runtime, leading to NULL pointer dereferences and kernel panics. The fix introduces CPU hotplug callbacks to properly create and remove per-CPU counter data, ensuring stability when CPUs change state during perf runs.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel vulnerability (CVE-2026-89460) affects the s390 architecture's perf subsystem. When CPUs are hotplugged online during a perf stat command running with task context, the kernel crashes due to a NULL pointer dereference. This occurs because the per-CPU event infrastructure is only allocated for CPUs online at event initialization, leaving newly online CPUs without initialized structures. When the scheduler runs the monitored task on such a CPU, the perf subsystem dereferences a NULL pointer, causing a kernel panic. The fix adds CPU hotplug prepare/dead callbacks to allocate and free per-CPU event data dynamically as CPUs go offline or come online, preventing the NULL pointer dereference.
Potential Impact
The vulnerability causes kernel panics (crashes) on s390 systems running perf commands with task context when CPUs are hotplugged online during execution. This can lead to denial of service due to kernel instability. There is no indication of privilege escalation or data corruption beyond the crash. The issue is specific to the s390 architecture and the perf subsystem's handling of CPU hotplug events.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to handle CPU hotplug events properly in the s390 perf subsystem by introducing prepare/dead callbacks that manage per-CPU event data lifecycle. Users should update to a kernel version that includes this fix. No additional mitigation is required once the patch is applied.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-qv9g-m2j2-jrgj
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-89460"]
Threat ID: 6aa4a01c55bf5e2cf5a8672c
Added to database: 09/12/2026, 00:43:08 UTC
Last enriched: 09/12/2026, 01:15:09 UTC
Last updated: 09/12/2026, 02:01:21 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.