diff --git a/arch/x86/events/intel/lbr.c b/arch/x86/events/intel/lbr.c
index a3dc3b5bc78d682ef40403e256fc88088e9c4871..1fb1ede03c40fba157befc1b3ff0015b1c0de2af 100644
--- a/arch/x86/events/intel/lbr.c
+++ b/arch/x86/events/intel/lbr.c
@@ -5,6 +5,7 @@
 #include <asm/perf_event.h>
 #include <asm/msr.h>
 #include <asm/insn.h>
+#include <linux/mm.h>
 
 #include "../perf_event.h"
 
@@ -894,9 +895,9 @@ static int branch_type(unsigned long from, unsigned long to, int abort)
 		 * The LBR logs any address in the IP, even if the IP just
 		 * faulted. This means userspace can control the from address.
 		 * Ensure we don't blindy read any address by validating it is
-		 * a known text address.
+		 * a known text address and not a vsyscall address.
 		 */
-		if (kernel_text_address(from)) {
+		if (kernel_text_address(from) && !in_gate_area_no_mm(from)) {
 			addr = (void *)from;
 			/*
 			 * Assume we can get the maximum possible size