CVE-2026-23435

{"id": "CVE-2026-23435", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6b089028bff1f2ff9e0c62b8f1faca1a620e5d6e", "lessThan": "886fa869153917d902784098922defa20c3a2fe5", "versionType": "git"}, {"status": "affected", "version": "7e772a93eb61cb6265bdd1c5bde17d0f2718b452", "lessThan": "c1dd1e2b722d3f1f2e4977dad8d1be78fdfb30cb", "versionType": "git"}, {"status": "affected", "version": "7e772a93eb61cb6265bdd1c5bde17d0f2718b452", "lessThan": "8d5fae6011260de209aaf231120e8146b14bc8e0", "versionType": "git"}, {"status": "affected", "version": "cf69b99805c263117305ac6dffbc85aaf9259d32", "versionType": "git"}, {"status": "affected", "version": "6.18.2", "lessThan": "6.18.20", "versionType": "semver"}, {"status": "affected", "version": "6.17.13", "lessThan": "6.18", "versionType": "semver"}], "programFiles": ["arch/x86/events/core.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.19"}, {"status": "unaffected", "version": "0", "lessThan": "6.19", "versionType": "semver"}, {"status": "unaffected", "version": "6.18.20", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.10", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["arch/x86/events/core.c"], "defaultStatus": "affected"}]}], "published": "2026-04-03T16:16:25.083", "references": [{"url": "https://git.kernel.org/stable/c/886fa869153917d902784098922defa20c3a2fe5", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/8d5fae6011260de209aaf231120e8146b14bc8e0", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/c1dd1e2b722d3f1f2e4977dad8d1be78fdfb30cb", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-476"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/x86: Move event pointer setup earlier in x86_pmu_enable()\n\nA production AMD EPYC system crashed with a NULL pointer dereference\nin the PMU NMI handler:\n\n BUG: kernel NULL pointer dereference, address: 0000000000000198\n RIP: x86_perf_event_update+0xc/0xa0\n Call Trace:\n <NMI>\n amd_pmu_v2_handle_irq+0x1a6/0x390\n perf_event_nmi_handler+0x24/0x40\n\nThe faulting instruction is `cmpq $0x0, 0x198(%rdi)` with RDI=0,\ncorresponding to the `if (unlikely(!hwc->event_base))` check in\nx86_perf_event_update() where hwc = &event->hw and event is NULL.\n\ndrgn inspection of the vmcore on CPU 106 showed a mismatch between\ncpuc->active_mask and cpuc->events[]:\n\n active_mask: 0x1e (bits 1, 2, 3, 4)\n events[1]: 0xff1100136cbd4f38 (valid)\n events[2]: 0x0 (NULL, but active_mask bit 2 set)\n events[3]: 0xff1100076fd2cf38 (valid)\n events[4]: 0xff1100079e990a90 (valid)\n\nThe event that should occupy events[2] was found in event_list[2]\nwith hw.idx=2 and hw.state=0x0, confirming x86_pmu_start() had run\n(which clears hw.state and sets active_mask) but events[2] was\nnever populated.\n\nAnother event (event_list[0]) had hw.state=0x7 (STOPPED|UPTODATE|ARCH),\nshowing it was stopped when the PMU rescheduled events, confirming the\nthrottle-then-reschedule sequence occurred.\n\nThe root cause is commit 7e772a93eb61 (\"perf/x86: Fix NULL event access\nand potential PEBS record loss\") which moved the cpuc->events[idx]\nassignment out of x86_pmu_start() and into step 2 of x86_pmu_enable(),\nafter the PERF_HES_ARCH check. This broke any path that calls\npmu->start() without going through x86_pmu_enable() -- specifically\nthe unthrottle path:\n\n perf_adjust_freq_unthr_events()\n -> perf_event_unthrottle_group()\n -> perf_event_unthrottle()\n -> event->pmu->start(event, 0)\n -> x86_pmu_start() // sets active_mask but not events[]\n\nThe race sequence is:\n\n 1. A group of perf events overflows, triggering group throttle via\n perf_event_throttle_group(). All events are stopped: active_mask\n bits cleared, events[] preserved (x86_pmu_stop no longer clears\n events[] after commit 7e772a93eb61).\n\n 2. While still throttled (PERF_HES_STOPPED), x86_pmu_enable() runs\n due to other scheduling activity. Stopped events that need to\n move counters get PERF_HES_ARCH set and events[old_idx] cleared.\n In step 2 of x86_pmu_enable(), PERF_HES_ARCH causes these events\n to be skipped -- events[new_idx] is never set.\n\n 3. The timer tick unthrottles the group via pmu->start(). Since\n commit 7e772a93eb61 removed the events[] assignment from\n x86_pmu_start(), active_mask[new_idx] is set but events[new_idx]\n remains NULL.\n\n 4. A PMC overflow NMI fires. The handler iterates active counters,\n finds active_mask[2] set, reads events[2] which is NULL, and\n crashes dereferencing it.\n\nMove the cpuc->events[hwc->idx] assignment in x86_pmu_enable() to\nbefore the PERF_HES_ARCH check, so that events[] is populated even\nfor events that are not immediately started. This ensures the\nunthrottle path via pmu->start() always finds a valid event pointer."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nperf/x86: Mover la configuraci\u00f3n del puntero de evento antes en x86_pmu_enable()\n\nUn sistema AMD EPYC de producci\u00f3n fall\u00f3 con una desreferencia de puntero NULL en el gestor NMI de la PMU:\n\n BUG: desreferencia de puntero NULL del kernel, direcci\u00f3n: 0000000000000198\n RIP: x86_perf_event_update+0xc/0xa0\n Traza de Llamada:\n [NMI]\n amd_pmu_v2_handle_irq+0x1a6/0x390\n perf_event_nmi_handler+0x24/0x40\n\nLa instrucci\u00f3n que caus\u00f3 el fallo es 'cmpq $0x0, 0x198(%rdi)' con RDI=0, correspondiente a la comprobaci\u00f3n 'if (unlikely(!hwc- event_base))' en x86_perf_event_update() donde hwc = &event- hw y event es NULL.\n\nLa inspecci\u00f3n con drgn del vmcore en la CPU 106 mostr\u00f3 una discrepancia entre cpuc- active_mask y cpuc- events[]:\n\n active_mask: 0x1e (bits 1, 2, 3, 4)\n events[1]: 0xff1100136cbd4f38 (v\u00e1lido)\n events[2]: 0x0 (NULL, pero el bit 2 de active_mask est\u00e1 activado)\n events[3]: 0xff1100076fd2cf38 (v\u00e1lido)\n events[4]: 0xff1100079e990a90 (v\u00e1lido)\n\nEl evento que deber\u00eda ocupar events[2] se encontr\u00f3 en event_list[2] con hw.idx=2 y hw.state=0x0, confirmando que x86_pmu_start() se hab\u00eda ejecutado (lo que borra hw.state y establece active_mask) pero events[2] nunca fue poblado.\n\nOtro evento (event_list[0]) ten\u00eda hw.state=0x7 (STOPPED|UPTODATE|ARCH), mostrando que se detuvo cuando la PMU reprogram\u00f3 los eventos, confirmando que la secuencia de estrangulamiento y luego reprogramaci\u00f3n ocurri\u00f3.\n\nLa causa ra\u00edz es el commit 7e772a93eb61 ( perf/x86: Solucionar acceso a evento NULL y posible p\u00e9rdida de registro PEBS ) que movi\u00f3 la asignaci\u00f3n de cpuc- events[idx] fuera de x86_pmu_start() y al paso 2 de x86_pmu_enable(), despu\u00e9s de la comprobaci\u00f3n PERF_HES_ARCH. Esto rompi\u00f3 cualquier ruta que llama a pmu- start() sin pasar por x86_pmu_enable() -- espec\u00edficamente la ruta de desestrangulamiento:\n\n perf_adjust_freq_unthr_events()\n - perf_event_unthrottle_group()\n - perf_event_unthrottle()\n - event- pmu- start(event, 0)\n - x86_pmu_start() // establece active_mask pero no events[]\n\nLa secuencia de la condici\u00f3n de carrera es:\n\n 1. Un grupo de eventos perf desborda, lo que activa el estrangulamiento del grupo a trav\u00e9s de perf_event_throttle_group(). Todos los eventos se detienen: los bits de active_mask se borran, events[] se preserva (x86_pmu_stop ya no borra events[] despu\u00e9s del commit 7e772a93eb61).\n\n 2. Mientras a\u00fan est\u00e1 estrangulado (PERF_HES_STOPPED), x86_pmu_enable() se ejecuta debido a otra actividad de planificaci\u00f3n. Los eventos detenidos que necesitan mover contadores obtienen PERF_HES_ARCH establecido y events[old_idx] borrado. En el paso 2 de x86_pmu_enable(), PERF_HES_ARCH hace que estos eventos se omitan -- events[new_idx] nunca se establece.\n\n 3. El tick del temporizador desestr\u00e1ngula el grupo a trav\u00e9s de pmu- start(). Dado que el commit 7e772a93eb61 elimin\u00f3 la asignaci\u00f3n de events[] de x86_pmu_start(), active_mask[new_idx] se establece pero events[new_idx] permanece NULL.\n\n 4. Se dispara una NMI de desbordamiento de PMC. El gestor itera los contadores activos, encuentra active_mask[2] establecido, lee events[2] que es NULL, y falla al desreferenciarlo.\n\nMover la asignaci\u00f3n de cpuc- events[hwc- idx] en x86_pmu_enable() a antes de la comprobaci\u00f3n PERF_HES_ARCH, para que events[] se pueble incluso para eventos que no se inician inmediatamente. Esto asegura que la ruta de desestrangulamiento a trav\u00e9s de pmu- start() siempre encuentre un puntero de evento v\u00e1lido."}], "lastModified": "2026-07-21T19:10:00.107", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7C298528-1754-41BD-B4E9-84A37AB7BA32", "versionEndExcluding": "6.18", "versionStartIncluding": "6.17.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "29896448-5F31-40A5-A909-2BC59D21590D", "versionEndExcluding": "6.18.20", "versionStartIncluding": "6.18.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D70DEFFE-AC47-4F3A-A2B2-2D67AB4CF3C8", "versionEndExcluding": "6.19.10", "versionStartIncluding": "6.19.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "35C8A871-4971-433E-A046-FC9F7B7D190A"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}