CVE-2026-31528

In the Linux kernel, the following vulnerability has been resolved:

perf: Make sure to use pmu_ctx->pmu for groups

Oliver reported that x86pmudel() ended up doing an out-of-bound memory access when groupschedin() fails and needs to roll back.

This should be handled by the transaction callbacks, but he found that when the group leader is a software event, the transaction handlers of the wrong PMU are used. Despite the movegroup case in perfeventopen() and groupschedin() using pmuctx->pmu.

Turns out, inherit uses event->pmu to clone the events, effectively undoing the movegroup case for all inherited contexts. Fix this by also making inherit use pmuctx->pmu, ensuring all inherited counters end up in the same pmu context.

Similarly, _perfeventread() should use equally use pmuctx->pmu for the group case.