CVE-2026-31528

In the Linux kernel, the following vulnerability has been resolved:

perf: Make sure to use pmu_ctx->pmu for groups

Oliver reported that x86_pmu_del() ended up doing an out-of-bound memory access

when group_sched_in() fails and needs to roll back.

This *should* be handled by the transaction callbacks, but he found that when

the group leader is a software event, the transaction handlers of the wrong PMU

are used. Despite the move_group case in perf_event_open() and group_sched_in()

using pmu_ctx->pmu.

Turns out, inherit uses event->pmu to clone the events, effectively undoing the

move_group case for all inherited contexts. Fix this by also making inherit use

pmu_ctx->pmu, ensuring all inherited counters end up in the same pmu context.

Similarly, __perf_event_read() should use equally use pmu_ctx->pmu for the

group case.