Linux Kernel CPU Hotplug Handling Vulnerability in s390 CPUMF Sampling

A vulnerability in the Linux kernel's handling of CPU hotplug events in the s390 architecture can lead to a use-after-free condition. When a CPU is removed, the hotplug handler deallocates all sampling data buffers for that CPU. However, if a performance event is still active on the removed CPU, the kernel attempts to read the samples from these buffers, which have already been freed and may have been reassigned. This can result in accessing invalid data, potentially leading to memory corruption.

Impact

Exploitation of this vulnerability can cause a use-after-free condition, where the kernel accesses freed memory that may have been reallocated, leading to invalid data being processed. This type of memory corruption can often be exploited to execute arbitrary code or cause a denial-of-service condition by crashing the system.