CVE-2026-23435

published 2026-04-03

CVE-2026-23435: In the Linux kernel, the following vulnerability has been resolved: perf/x86: Move event pointer setup earlier in x86_pmu_enable() A production AMD EPYC system…

Priority P4 21 medium 5.5 CVSS 3.1

AV L AC L PR L UI N S U C N I N A H

In the Linux kernel, the following vulnerability has been resolved:

perf/x86: Move event pointer setup earlier in x86_pmu_enable()

A production AMD EPYC system crashed with a NULL pointer dereference
in the PMU NMI handler:

BUG: kernel NULL pointer dereference, address: 0000000000000198
RIP: x86_perf_event_update+0xc/0xa0
Call Trace:

amd_pmu_v2_handle_irq+0x1a6/0x390
perf_event_nmi_handler+0x24/0x40

The faulting instruction is `cmpq $0x0, 0x198(%rdi)` with RDI=0,
corresponding to the `if (unlikely(!hwc->event_base))` check in
x86_perf_event_update() where hwc = &event->hw and event is NULL.

drgn inspection of the vmcore on CPU 106 showed a mismatch between
cpuc->active_mask and cpuc->events[]:

active_mask: 0x1e (bits 1, 2, 3, 4)
events[1]: 0xff1100136cbd4f38 (valid)
events[2]: 0x0 (NULL, but active_mask bit 2 set)
events[3]: 0xff1100076fd2cf38 (valid)
events[4]: 0xff1100079e990a90 (valid)

The event that should occupy events[2] was found in event_list[2]
with hw.idx=2 and hw.state=0x0, confirming x86_pmu_start() had run
(which clears hw.state and sets active_mask) but events[2] was
never populated.

Another event (event_list[0]) had hw.state=0x7 (STOPPED|UPTODATE|ARCH),
showing it was stopped when the PMU rescheduled events, confirming the
throttle-then-reschedule sequence occurred.

The root cause is commit 7e772a93eb61 ("perf/x86: Fix NULL event access
and potential PEBS record loss") which moved the cpuc->events[idx]
assignment out of x86_pmu_start() and into step 2 of x86_pmu_enable(),
after the PERF_HES_ARCH check. This broke any path that calls
pmu->start() without going through x86_pmu_enable() -- specifically
the unthrottle path:

perf_adjust_freq_unthr_events()
-> perf_event_unthrottle_group()
-> perf_event_unthrottle()
-> event->pmu->start(event, 0)
-> x86_pmu_start() // sets active_mask but not events[]

The race sequence is:

1. A group of perf events overflows, triggering group throttle via
perf_event_throttle_group(). All events are stopped: act

Affected

20 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 6.19.10-1 (forky)	linux 6.19.10-1 (forky)
linux	linux	—	—
linux	linux	—	—
linux	linux	>= 6.17.13 < 6.18	6.18
linux	linux	>= 6.18.2 < 6.18.20	6.18.20
linux	linux	>= 6b089028bff1f2ff9e0c62b8f1faca1a620e5d6e < 886fa869153917d902784098922defa20c3a2fe5	886fa869153917d902784098922defa20c3a2fe5
linux	linux	>= 7e772a93eb61cb6265bdd1c5bde17d0f2718b452 < c1dd1e2b722d3f1f2e4977dad8d1be78fdfb30cb	c1dd1e2b722d3f1f2e4977dad8d1be78fdfb30cb
linux	linux	>= 7e772a93eb61cb6265bdd1c5bde17d0f2718b452 < 8d5fae6011260de209aaf231120e8146b14bc8e0	8d5fae6011260de209aaf231120e8146b14bc8e0
linux	linux_kernel	—	—
linux	linux_kernel	—	—
linux	linux_kernel	—	—
linux	linux_kernel	—	—
linux	linux_kernel	—	—
linux	linux_kernel	—	—
linux	linux_kernel	—	—
linux	linux_kernel	—	—
linux	linux_kernel	>= 0 < 6.19.10-1	6.19.10-1
linux	linux_kernel	>= 6.17.13 < 6.18	6.18
linux	linux_kernel	>= 6.18.2 < 6.18.20	6.18.20
linux	linux_kernel	>= 6.19.1 < 6.19.10	6.19.10

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-476 CWE-364