CVE-2026-31528 is a vulnerability in the Linux kernel's perf subsystem where the function x86_pmu_del() could perform out-of-bound memory access when group_sched_in() fails and rolls back. The root cause was that inherited performance events cloned using event->pmu instead of pmu_ctx->pmu, undoing the intended move_group context fix. This led to transaction handlers of the wrong PMU being used, causing memory safety issues. The fix ensures inherit and __perf_event_read() use pmu_ctx->pmu consistently, aligning all inherited counters to the correct PMU context. Multiple Linux kernel versions prior to 6.8.0 and its variants are affected. The vulnerability is rated high severity with a CVSS 3.1 score of 7.8 (Local Attack Vector, Low Complexity, Low Privileges Required, No User Interaction, Unchanged Scope, High Confidentiality, Integrity, and Availability impacts).

Successful exploitation could lead to out-of-bound memory access in kernel space, potentially allowing a local attacker with limited privileges to cause system compromise including confidentiality, integrity, and availability impacts. The flaw affects performance monitoring event handling, which could be leveraged to disrupt system stability or escalate privileges.

A patch is available and should be applied promptly. The vendor advisory from Ubuntu confirms fixes in Linux kernel versions 6.8.0 and later. Users should update their systems to the fixed kernel versions and reboot to apply the changes. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be required. No alternative mitigations are indicated by the vendor advisory.