{"id":"AZL-103988","summary":"CVE-2026-97499 affecting package kernel 6.6.157.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ncoresight: perf: Retrieve path and source from event data\n\nETM perf callbacks currently use the per-CPU csdev_src pointer, which\ncan race with updates during device registration and unregistration.\n\nThe AUX setup already builds and stores the path in the event data.\nUse this path to retrieve the source instead of csdev_src to avoid\nthe race.\n\nExport coresight_get_source() and add etm_event_get_ctxt_path() to\nretrieve the context's path and its source with READ_ONCE() /\nWRITE_ONCE() accessors. Give the comments to explain why this\napproach is safe when pause or resume callbacks preempt the disable\ncallback (e.g. via NMI).","modified":"2026-09-25T14:15:46.721538758Z","published":"2026-09-24T17:17:27Z","upstream":["CVE-2026-97499"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97499"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.157.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-103988.json"}}],"schema_version":"1.9.0"}