{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23435", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:46.017Z", "datePublished": "2026-04-03T15:15:20.465Z", "dateUpdated": "2026-05-11T22:06:51.182Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:06:51.182Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/x86: Move event pointer setup earlier in x86_pmu_enable()\n\nA production AMD EPYC system crashed with a NULL pointer dereference\nin the PMU NMI handler:\n\n BUG: kernel NULL pointer dereference, address: 0000000000000198\n RIP: x86_perf_event_update+0xc/0xa0\n Call Trace:\n <NMI>\n amd_pmu_v2_handle_irq+0x1a6/0x390\n perf_event_nmi_handler+0x24/0x40\n\nThe faulting instruction is `cmpq $0x0, 0x198(%rdi)` with RDI=0,\ncorresponding to the `if (unlikely(!hwc->event_base))` check in\nx86_perf_event_update() where hwc = &event->hw and event is NULL.\n\ndrgn inspection of the vmcore on CPU 106 showed a mismatch between\ncpuc->active_mask and cpuc->events[]:\n\n active_mask: 0x1e (bits 1, 2, 3, 4)\n events[1]: 0xff1100136cbd4f38 (valid)\n events[2]: 0x0 (NULL, but active_mask bit 2 set)\n events[3]: 0xff1100076fd2cf38 (valid)\n events[4]: 0xff1100079e990a90 (valid)\n\nThe event that should occupy events[2] was found in event_list[2]\nwith hw.idx=2 and hw.state=0x0, confirming x86_pmu_start() had run\n(which clears hw.state and sets active_mask) but events[2] was\nnever populated.\n\nAnother event (event_list[0]) had hw.state=0x7 (STOPPED|UPTODATE|ARCH),\nshowing it was stopped when the PMU rescheduled events, confirming the\nthrottle-then-reschedule sequence occurred.\n\nThe root cause is commit 7e772a93eb61 (\"perf/x86: Fix NULL event access\nand potential PEBS record loss\") which moved the cpuc->events[idx]\nassignment out of x86_pmu_start() and into step 2 of x86_pmu_enable(),\nafter the PERF_HES_ARCH check. This broke any path that calls\npmu->start() without going through x86_pmu_enable() -- specifically\nthe unthrottle path:\n\n perf_adjust_freq_unthr_events()\n -> perf_event_unthrottle_group()\n -> perf_event_unthrottle()\n -> event->pmu->start(event, 0)\n -> x86_pmu_start() // sets active_mask but not events[]\n\nThe race sequence is:\n\n 1. A group of perf events overflows, triggering group throttle via\n perf_event_throttle_group(). All events are stopped: active_mask\n bits cleared, events[] preserved (x86_pmu_stop no longer clears\n events[] after commit 7e772a93eb61).\n\n 2. While still throttled (PERF_HES_STOPPED), x86_pmu_enable() runs\n due to other scheduling activity. Stopped events that need to\n move counters get PERF_HES_ARCH set and events[old_idx] cleared.\n In step 2 of x86_pmu_enable(), PERF_HES_ARCH causes these events\n to be skipped -- events[new_idx] is never set.\n\n 3. The timer tick unthrottles the group via pmu->start(). Since\n commit 7e772a93eb61 removed the events[] assignment from\n x86_pmu_start(), active_mask[new_idx] is set but events[new_idx]\n remains NULL.\n\n 4. A PMC overflow NMI fires. The handler iterates active counters,\n finds active_mask[2] set, reads events[2] which is NULL, and\n crashes dereferencing it.\n\nMove the cpuc->events[hwc->idx] assignment in x86_pmu_enable() to\nbefore the PERF_HES_ARCH check, so that events[] is populated even\nfor events that are not immediately started. This ensures the\nunthrottle path via pmu->start() always finds a valid event pointer."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/x86/events/core.c"], "versions": [{"version": "6b089028bff1f2ff9e0c62b8f1faca1a620e5d6e", "lessThan": "886fa869153917d902784098922defa20c3a2fe5", "status": "affected", "versionType": "git"}, {"version": "7e772a93eb61cb6265bdd1c5bde17d0f2718b452", "lessThan": "c1dd1e2b722d3f1f2e4977dad8d1be78fdfb30cb", "status": "affected", "versionType": "git"}, {"version": "7e772a93eb61cb6265bdd1c5bde17d0f2718b452", "lessThan": "8d5fae6011260de209aaf231120e8146b14bc8e0", "status": "affected", "versionType": "git"}, {"version": "cf69b99805c263117305ac6dffbc85aaf9259d32", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/x86/events/core.c"], "versions": [{"version": "6.19", "status": "affected"}, {"version": "0", "lessThan": "6.19", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.20", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.10", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18.2", "versionEndExcluding": "6.18.20"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "6.19.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.0"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17.13"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/886fa869153917d902784098922defa20c3a2fe5"}, {"url": "https://git.kernel.org/stable/c/c1dd1e2b722d3f1f2e4977dad8d1be78fdfb30cb"}, {"url": "https://git.kernel.org/stable/c/8d5fae6011260de209aaf231120e8146b14bc8e0"}], "title": "perf/x86: Move event pointer setup earlier in x86_pmu_enable()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "7C298528-1754-41BD-B4E9-84A37AB7BA32", "versionEndExcluding": "6.18", "versionStartIncluding": "6.17.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "29896448-5F31-40A5-A909-2BC59D21590D", "versionEndExcluding": "6.18.20", "versionStartIncluding": "6.18.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D70DEFFE-AC47-4F3A-A2B2-2D67AB4CF3C8", "versionEndExcluding": "6.19.10", "versionStartIncluding": "6.19.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:-:*:*:*:*:*:*", "matchCriteriaId": "35C8A871-4971-433E-A046-FC9F7B7D190A", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/x86: Move event pointer setup earlier in x86_pmu_enable()\n\nA production AMD EPYC system crashed with a NULL pointer dereference\nin the PMU NMI handler:\n\n BUG: kernel NULL pointer dereference, address: 0000000000000198\n RIP: x86_perf_event_update+0xc/0xa0\n Call Trace:\n <NMI>\n amd_pmu_v2_handle_irq+0x1a6/0x390\n perf_event_nmi_handler+0x24/0x40\n\nThe faulting instruction is `cmpq $0x0, 0x198(%rdi)` with RDI=0,\ncorresponding to the `if (unlikely(!hwc->event_base))` check in\nx86_perf_event_update() where hwc = &event->hw and event is NULL.\n\ndrgn inspection of the vmcore on CPU 106 showed a mismatch between\ncpuc->active_mask and cpuc->events[]:\n\n active_mask: 0x1e (bits 1, 2, 3, 4)\n events[1]: 0xff1100136cbd4f38 (valid)\n events[2]: 0x0 (NULL, but active_mask bit 2 set)\n events[3]: 0xff1100076fd2cf38 (valid)\n events[4]: 0xff1100079e990a90 (valid)\n\nThe event that should occupy events[2] was found in event_list[2]\nwith hw.idx=2 and hw.state=0x0, confirming x86_pmu_start() had run\n(which clears hw.state and sets active_mask) but events[2] was\nnever populated.\n\nAnother event (event_list[0]) had hw.state=0x7 (STOPPED|UPTODATE|ARCH),\nshowing it was stopped when the PMU rescheduled events, confirming the\nthrottle-then-reschedule sequence occurred.\n\nThe root cause is commit 7e772a93eb61 (\"perf/x86: Fix NULL event access\nand potential PEBS record loss\") which moved the cpuc->events[idx]\nassignment out of x86_pmu_start() and into step 2 of x86_pmu_enable(),\nafter the PERF_HES_ARCH check. This broke any path that calls\npmu->start() without going through x86_pmu_enable() -- specifically\nthe unthrottle path:\n\n perf_adjust_freq_unthr_events()\n -> perf_event_unthrottle_group()\n -> perf_event_unthrottle()\n -> event->pmu->start(event, 0)\n -> x86_pmu_start() // sets active_mask but not events[]\n\nThe race sequence is:\n\n 1. A group of perf events overflows, triggering group throttle via\n perf_event_throttle_group(). All events are stopped: active_mask\n bits cleared, events[] preserved (x86_pmu_stop no longer clears\n events[] after commit 7e772a93eb61).\n\n 2. While still throttled (PERF_HES_STOPPED), x86_pmu_enable() runs\n due to other scheduling activity. Stopped events that need to\n move counters get PERF_HES_ARCH set and events[old_idx] cleared.\n In step 2 of x86_pmu_enable(), PERF_HES_ARCH causes these events\n to be skipped -- events[new_idx] is never set.\n\n 3. The timer tick unthrottles the group via pmu->start(). Since\n commit 7e772a93eb61 removed the events[] assignment from\n x86_pmu_start(), active_mask[new_idx] is set but events[new_idx]\n remains NULL.\n\n 4. A PMC overflow NMI fires. The handler iterates active counters,\n finds active_mask[2] set, reads events[2] which is NULL, and\n crashes dereferencing it.\n\nMove the cpuc->events[hwc->idx] assignment in x86_pmu_enable() to\nbefore the PERF_HES_ARCH check, so that events[] is populated even\nfor events that are not immediately started. This ensures the\nunthrottle path via pmu->start() always finds a valid event pointer."}], "id": "CVE-2026-23435", "lastModified": "2026-04-23T20:59:39.733", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-04-03T16:16:25.083", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/886fa869153917d902784098922defa20c3a2fe5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8d5fae6011260de209aaf231120e8146b14bc8e0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c1dd1e2b722d3f1f2e4977dad8d1be78fdfb30cb"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: perf/x86: Move event pointer setup earlier in x86_pmu_enable()", "id": "2454873", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454873"}, "csaw": false, "cwe": "CWE-364", "details": ["A flaw was found in the Linux kernel's performance monitoring unit (PMU) subsystem. A race condition can occur during the unthrottling of performance events, leading to a mismatch between active performance counters and their corresponding event pointers. This can result in a NULL pointer dereference within the PMU's Non-Maskable Interrupt (NMI) handler, causing the system to crash and resulting in a Denial of Service (DoS)."], "name": "CVE-2026-23435", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-03T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23435\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23435\nhttps://lore.kernel.org/linux-cve-announce/2026040312-CVE-2026-23435-e721@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[6b089028bff1f2ff9e0c62b8f1faca1a620e5d6e,886fa869153917d902784098922defa20c3a2fe5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7e772a93eb61cb6265bdd1c5bde17d0f2718b452,c1dd1e2b722d3f1f2e4977dad8d1be78fdfb30cb)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7e772a93eb61cb6265bdd1c5bde17d0f2718b452,8d5fae6011260de209aaf231120e8146b14bc8e0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "cf69b99805c263117305ac6dffbc85aaf9259d32"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.20,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.10,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-29T00:34:36.635674+00:00", "value": {"mitigation_remediation": ["Apply the latest Linux kernel update that includes commit\u202f7e772a93eb61.", "Reboot the system to load the updated kernel.", "Monitor system logs for any remaining PMU-related errors."], "summary": {"action": "Patch immediately", "impact": "Kernel crash (Denial of Service)"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Linux kernel in all releases that contain the faulty commit before it was corrected. Both standard Linux distributions and custom builds that have not yet applied the patch are susceptible.", "description_and_impact": "A null pointer dereference occurs in the Linux kernel when the perf subsystem attempts to handle a PMU overflow after an unthrottle operation. The bug originates from moving the assignment of event pointers out of the routine that starts the PMU, leaving the events array with a NULL entry that the crash handler later dereferences. The result is a kernel panic, cutting system operation.", "risk_and_exploitability": "The flaw is a local kernel pointer dereference (CWE\u2011364) and a NULL pointer dereference (CWE\u2011476) with exploitation requiring privileged or local code execution. The CVSS score of 5.5 indicates moderate severity, and the EPSS <\u202f1\u202f% shows a very low likelihood of exploitation. An attacker could trigger a denial\u2011of\u2011service by inducing a perf event group overflow and then unthrottling, but the vulnerability is not listed in the CISA KEV catalog."}}}}, "created": "2026-04-03T21:14:03.086220+00:00", "updated": "2026-04-29T00:45:26.156371+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}