CVE-2026-89460— Linux kernel 安全漏洞
一分钟漏洞结论
影响对象
Linux Linux
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于s390/cpum_cf在首次事件初始化时动态分配struct cpu_cf_events结构不充分且未处理CPU热插拔，导致cpumf_pmu_add()函数引用空指针，可能造成内核崩溃。
影响版本矩阵 12
| 厂商 | 产品 | 版本范围 | 状态 |
|---|---|---|---|
| Linux | Linux | 9b9cf3c77e7e090b30657b3d2c288deb58dfb4f2< 991be92489bc7b1b6e7903debb96bd58c892dee4 |
affected |
9b9cf3c77e7e090b30657b3d2c288deb58dfb4f2< 777d040c2f91d8d929b4a32333dfe4102b27caea |
affected | ||
9b9cf3c77e7e090b30657b3d2c288deb58dfb4f2< dcce7a06ea690d5cf46a705a9b74cf0398ac091f |
affected | ||
9b9cf3c77e7e090b30657b3d2c288deb58dfb4f2< 71d46de9153e067c63a15f3b00e6364e1c0230f8 |
affected | ||
9b9cf3c77e7e090b30657b3d2c288deb58dfb4f2< 337bd95507a16063687cfc286ea90de5cca48c37 |
affected | ||
6.5 |
affected | ||
< 6.5 |
unaffected | ||
6.6.157≤ 6.6.* |
unaffected | ||
| … +4 条更多 | |||
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-89460 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks
来源: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks
The command 'perf stat -e cycles -- <command>' crashes the kernel
when CPUs are hotplug added during that run.
Root cause is the allocation of struct cpu_cf_events at first
event initialization. The allocation is dynamic and the first
event that has task context creates such a structure for
each online CPU. This is not sufficient. CPUs may be offline
during event creation and can be set online during the
perf run time. For example commands
# echo 0 > /sys/devices/system/cpu/cpu1/online
# perf stat -e cycles -i -- stress-ng -t10s --matrix X
# sleep 1
# echo 1 > /sys/devices/system/cpu/cpu1/online
create an event for CPUs 0,2-X. Since the events are created with
task-context, the scheduler will eventually schedule the program
on CPU1. This CPU has not created and initialized any per
CPU event infrastructure as that CPU was not online at the time
of the perf invocation. Thus when the scheduler runs stress-ng
on CPU1, the function cpumf_pmu_add() refers to a NULL pointer:
struct cpu_cf_events *cpuhw = this_cpu_cfhw();
This function call is invoked after the task stress-ng has been
made runnable on CPU1. And this_cpu_cfhw() returns NULL.
The result is a panic:
Unable to handle kernel pointer dereference in virtual kernel address space
Failing address: 0000000000000000 TEID: 0000000000000483
....
Krnl PSW : 0404d00180000000 000003ef8291fd0c (cpumf_pmu_add+0x3c/0x80)
....
Call Trace:
[<000003ef8291fd0c>] cpumf_pmu_add+0x3c/0x80
[<000003ef82bb5e3e>] event_sched_in+0xae/0x190
[<000003ef82bb60d6>] merge_sched_in+0x1b6/0x390
[<000003ef82bb65b8>] visit_groups_merge.constprop.0.isra.0+0x308/0x5b0
[<000003ef82bb689a>] pmu_groups_sched_in+0x3a/0x50
[<000003ef82bb6a30>] ctx_sched_in+0x180/0x260
[<000003ef82bb780c>] perf_event_context_sched_in+0x11c/0x2d0
[<000003ef82bb79ee>] __perf_event_task_sched_in+0x2e/0xc0
[<000003ef82994834>] finish_task_switch.isra.0+0x1a4/0x250
....
Last Breaking-Event-Address:
[<000003ef8291f1d8>] this_cpu_cfhw+0x38/0x40
The issue arises only in per-task context when the CPUMF facility is
used and the scheduler picks a random CPU for such a process to run on.
The scheduler enables the CPUMF infrastructure via PMU callback
functions pmu::add() and pmu::del().
Introduce a CPU hotplug prepare/dead callback pair which creates and
removes the per CPU counter data while the CPU is offline. Count the
users which track every CPU (cpu == -1), that is perf_event_open()
events with task context and /dev/hwctr device sessions, in the new
counter cpu_cf_root::tskcnt, protected by pmc_reserve_mutex.
This ensures the infrastructure is available when
new CPU is selected to run the per-task context process.
In cpum_cf_free_root() and cpum_cf_free_cpu() ensure the reference
pointer to data structures is set to NULL before the data is freed
to prevent interrupt handlers to access stale data.
[gor@linux.ibm.com: change commit message]
来源: CVE Program / CVE List V5
CVSS Information
N/A
来源: CVE Program / CVE List V5
Vulnerability Type
N/A
来源: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Description
Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于s390/cpum_cf在首次事件初始化时动态分配struct cpu_cf_events结构不充分且未处理CPU热插拔，导致cpumf_pmu_add()函数引用空指针，可能造成内核崩溃。
来源: 中国国家信息安全漏洞库 CNNVD
CVSS Information
N/A
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Type
N/A
来源: 中国国家信息安全漏洞库 CNNVD
受影响产品
二、漏洞 CVE-2026-89460 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-89460 的情报信息
请登录查看更多情报信息。
CVE-2026-89460 补丁与修复 (5)
同批安全公告 · Linux · 2026-09-11 · 共 431 条
| CVE-2026-89688 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-89656 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-89655 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-89658 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-89660 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-89659 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-89662 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-89669 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-89674 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-89675 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-89676 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-89677 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-89681 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-89686 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-89703 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-89479 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-89478 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-89702 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-89482 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2026-89708 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
显示前 20 条，共 431 条。 查看全部 → →
IV. Related Vulnerabilities
V. Comments for CVE-2026-89460
暂无评论