CVE-2026-53114: Linux AMD IBS NMI Handler Denial of Service

Technical summary

The vulnerability exists in the Linux kernel's perf/amd/ibs subsystem where perf_allow_kernel() is invoked from the NMI handler context. NMI handlers operate at a privileged level where calling functions that may sleep, acquire locks, or otherwise interact with the scheduler is unsafe and can cause a kernel panic or fatal system behavior. The remediation captures the kernel permission state at event-initialization time by storing it in the event->hw.flags field, allowing the NMI handler to reference this cached flag instead of making a live function call. This pattern ensures that permission checks occur in safe context (process context) rather than in the atomic NMI handler.

Business impact

Local privilege escalation attacks can exploit this flaw to crash systems running vulnerable kernels. While the vulnerability requires local access and standard user privileges, successful exploitation causes an immediate denial of service affecting any system running affected AMD-based infrastructure. For environments relying on performance monitoring with AMD IBS enabled, this creates operational risk; affected systems may require emergency reboots and could disrupt monitoring pipelines until patched.

Affected systems

The Linux kernel across all versions incorporating the vulnerable AMD IBS implementation are affected. This impacts systems with AMD processors where IBS performance monitoring is available and potentially active. Specific kernel versions should be verified against official Linux kernel security advisories, as the scope of affected releases depends on when the vulnerable code was introduced and merged into mainline.

Exploitability

Exploitability is moderate. The vulnerability requires local code execution with standard user privileges (indicated by PR:L in the CVSS vector), making it inaccessible to remote attackers. However, any authenticated local user can initialize a perf event with AMD IBS and trigger the vulnerable NMI handler path. The attack is straightforward—no complex race conditions or special hardware setup is required beyond a standard AMD system with IBS support enabled.

Remediation

Apply kernel patches that implement the fix: relocate the perf_allow_kernel() check from the NMI handler to event-initialization time, storing the result in event->hw.flags. Users should obtain patches from their Linux distribution's security advisories. Systems using AMD-based platforms and running affected kernel versions should prioritize testing and deploying patches in maintenance windows.

Patch guidance

Coordinate patch deployment through your distribution's kernel update channels. For enterprise Linux (RHEL, Ubuntu LTS, SLES, etc.), check for kernel security updates addressing this CVE. Test patches in non-production environments first, particularly on AMD-based systems where IBS monitoring is in use. If you cannot immediately patch, consider disabling AMD IBS performance monitoring if operationally feasible until updates are available. Verify patch installation by confirming kernel version post-update matches your distributor's advisory.

Detection guidance

Monitor kernel logs for unusual NMI-related panics or system hangs correlated with perf event creation, especially on AMD systems. If you actively use perf with AMD IBS, establish baseline performance profiles pre-patch and watch for unexpected crashes during event initialization or sampling. Systemwide monitoring tools may reveal NMI storms or handler anomalies preceding crashes. However, detection of exploitation attempts is difficult; the best indicator is a system crash following perf event creation with AMD IBS.

Why prioritize this

Although rated MEDIUM severity (CVSS 5.5), this vulnerability warrants priority patching because it causes guaranteed denial of service via local user action on affected AMD systems. Environments relying on AMD hardware and kernel-level performance monitoring should treat this as high-priority. The low barrier to exploitation (standard user privileges, simple trigger) and the severe consequence (system crash) justify accelerated patching timelines despite the local-access requirement.

Risk score, explained

The CVSS 3.1 score of 5.5 reflects a local attack vector (AV:L), low complexity (AC:L), and low privilege requirement (PR:L), resulting in high availability impact (A:H) with no confidentiality or integrity compromise. The score appropriately captures the local-only, denial-of-service nature of the flaw. However, the operational consequence—crashing systems actively using AMD IBS monitoring—may justify higher priority in threat modeling depending on your infrastructure's reliance on AMD performance-critical workloads.

Frequently asked questions