{ "cveId": "CVE-2026-23435", "url": "https://patchblox.com/security/cve/CVE-2026-23435", "summary": "CVE-2026-23435 is fixed in 23 products on 1 platform, first by DEBIAN-CVE-2026-23435, released April 3, 2026. It is not reported as exploited. Patch Radar priority: Routine.", "title": "linux: In the Linux kernel, the following vulnerability has been resolved: perf/x86: Move event pointer setup earlier in x8...", "description": "In the Linux kernel, the following vulnerability has been resolved: perf/x86: Move event pointer setup earlier in x86_pmu_enable() A production AMD EPYC system crashed with a NULL pointer dereference in the PMU NMI handler: BUG: kernel NULL pointer dereference, address: 0000000000000198 RIP: x86_perf_event_update\u002B0xc/0xa0 Call Trace: \u003CNMI\u003E amd_pmu_v2_handle_irq\u002B0x1a6/0x390 perf_event_nmi_handler\u002B0x24/0x40 The faulting instruction is \u0060cmpq $0x0, 0x198(%rdi)\u0060 with RDI=0, corresponding to the \u0060if (unlikely(!hwc-\u003Eevent_base))\u0060 check in x86_perf_event_update() where hwc = \u0026event-\u003Ehw and event is NULL. drgn inspection of the vmcore on CPU 106 showed a mismatch between cpuc-\u003Eactive_mask and cpuc-\u003Eevents[]: active_mask: 0x1e (bits 1, 2, 3, 4) events[1]: 0xff1100136cbd4f38 (valid) events[2]: 0x0 (NULL, but active_mask bit 2 set) events[3]: 0xff1100076fd2cf38 (valid) events[4]: 0xff1100079e990a90 (valid) The event that should occupy events[2] was found in event_list[2] with hw.idx=2 and hw.state=0x0, confirming x86_pmu_start() had run (which clears hw.state and sets active_mask) but events[2] was never populated. Another event (event_list[0]) had hw.state=0x7 (STOPPED|UPTODATE|ARCH), showing it was stopped when the PMU rescheduled events, confirming the throttle-then-reschedule sequence occurred. The root cause is commit 7e772a93eb61 (\u0022perf/x86: Fix NULL event access and potential PEBS record loss\u0022) which moved the cpuc-\u003Eevents[idx] assignment out of x86_pmu_start() and into step 2 of x86_pmu_enable(), after the PERF_HES_ARCH check. This broke any path that calls pmu-\u003Estart() without going through x86_pmu_enable() -- specifically the unthrottle path: perf_adjust_freq_unthr_events() -\u003E perf_event_unthrottle_group() -\u003E perf_event_unthrottle() -\u003E event-\u003Epmu-\u003Estart(event, 0) -\u003E x86_pmu_start() // sets active_mask but not events[] The race sequence is: 1. A group of perf events overflows, triggering group throttle via perf_event_throttle_group(). All events are stopped: active_mask bits cleared, events[] preserved (x86_pmu_stop no longer clears events[] after commit 7e772a93eb61). 2. While still throttled (PERF_HES_STOPPED), x86_pmu_enable() runs due to other scheduling activity. Stopped events that need to move counters get PERF_HES_ARCH set and events[old_idx] cleared. In step 2 of x86_pmu_enable(), PERF_HES_ARCH causes these events to be skipped -- events[new_idx] is never set. 3. The timer tick unthrottles the group via pmu-\u003Estart(). Since commit 7e772a93eb61 removed the events[] assignment from x86_pmu_start(), active_mask[new_idx] is set but events[new_idx] remains NULL. 4. A PMC overflow NMI fires. The handler iterates active counters, finds active_mask[2] set, reads events[2] which is NULL, and crashes dereferencing it. Move the cpuc-\u003Eevents[hwc-\u003Eidx] assignment in x86_pmu_enable() to before the PERF_HES_ARCH check, so that events[] is populated even for events that are not immediately started. This ensures the unthrottle path via pmu-\u003Estart() always finds a valid event pointer.", "published": "2026-04-03T16:16:25Z", "severity": "medium", "cvss": 5.5, "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "epss": 0.00125, "epssPercentile": 0.02249, "priority": "Routine", "priorityTier": 4, "exploited": false, "vendorExploited": false, "disclosed": false, "fixes": [ { "platform": "linux", "product": "bpftool6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.20-20.229.amzn2023", "fix": "ALAS2023-2026-1596", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1596", "released": "2026-04-27T09:00:00Z" }, { "platform": "linux", "product": "bpftool6.18-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.20-20.229.amzn2023", "fix": "ALAS2023-2026-1596", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1596", "released": "2026-04-27T09:00:00Z" }, { "platform": "linux", "product": "kernel-livepatch-6.18.20-20.229", "release": "amzn 2023", "fixedVersion": "1:1.0-0.amzn2023", "fix": "ALAS2023-2026-1596", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1596", "released": "2026-04-27T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.20-20.229.amzn2023", "fix": "ALAS2023-2026-1596", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1596", "released": "2026-04-27T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.20-20.229.amzn2023", "fix": "ALAS2023-2026-1596", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1596", "released": "2026-04-27T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-debuginfo-common-aarch64", "release": "amzn 2023", "fixedVersion": "1:6.18.20-20.229.amzn2023", "fix": "ALAS2023-2026-1596", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1596", "released": "2026-04-27T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-debuginfo-common-x86_64", "release": "amzn 2023", "fixedVersion": "1:6.18.20-20.229.amzn2023", "fix": "ALAS2023-2026-1596", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1596", "released": "2026-04-27T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-devel", "release": "amzn 2023", "fixedVersion": "1:6.18.20-20.229.amzn2023", "fix": "ALAS2023-2026-1596", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1596", "released": "2026-04-27T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-headers", "release": "amzn 2023", "fixedVersion": "1:6.18.20-20.229.amzn2023", "fix": "ALAS2023-2026-1596", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1596", "released": "2026-04-27T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-libbpf", "release": "amzn 2023", "fixedVersion": "1:6.18.20-20.229.amzn2023", "fix": "ALAS2023-2026-1596", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1596", "released": "2026-04-27T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-libbpf-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.20-20.229.amzn2023", "fix": "ALAS2023-2026-1596", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1596", "released": "2026-04-27T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-libbpf-devel", "release": "amzn 2023", "fixedVersion": "1:6.18.20-20.229.amzn2023", "fix": "ALAS2023-2026-1596", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1596", "released": "2026-04-27T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-libbpf-static", "release": "amzn 2023", "fixedVersion": "1:6.18.20-20.229.amzn2023", "fix": "ALAS2023-2026-1596", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1596", "released": "2026-04-27T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-modules-extra", "release": "amzn 2023", "fixedVersion": "1:6.18.20-20.229.amzn2023", "fix": "ALAS2023-2026-1596", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1596", "released": "2026-04-27T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-modules-extra-common", "release": "amzn 2023", "fixedVersion": "1:6.18.20-20.229.amzn2023", "fix": "ALAS2023-2026-1596", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1596", "released": "2026-04-27T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-tools", "release": "amzn 2023", "fixedVersion": "1:6.18.20-20.229.amzn2023", "fix": "ALAS2023-2026-1596", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1596", "released": "2026-04-27T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-tools-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.20-20.229.amzn2023", "fix": "ALAS2023-2026-1596", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1596", "released": "2026-04-27T09:00:00Z" }, { "platform": "linux", "product": "kernel6.18-tools-devel", "release": "amzn 2023", "fixedVersion": "1:6.18.20-20.229.amzn2023", "fix": "ALAS2023-2026-1596", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1596", "released": "2026-04-27T09:00:00Z" }, { "platform": "linux", "product": "linux", "release": "Debian 14", "fixedVersion": "6.19.10-1", "fix": "DEBIAN-CVE-2026-23435", "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-23435", "released": "2026-04-03T16:16:25Z" }, { "platform": "linux", "product": "perf6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.20-20.229.amzn2023", "fix": "ALAS2023-2026-1596", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1596", "released": "2026-04-27T09:00:00Z" }, { "platform": "linux", "product": "perf6.18-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.20-20.229.amzn2023", "fix": "ALAS2023-2026-1596", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1596", "released": "2026-04-27T09:00:00Z" }, { "platform": "linux", "product": "python3-perf6.18", "release": "amzn 2023", "fixedVersion": "1:6.18.20-20.229.amzn2023", "fix": "ALAS2023-2026-1596", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1596", "released": "2026-04-27T09:00:00Z" }, { "platform": "linux", "product": "python3-perf6.18-debuginfo", "release": "amzn 2023", "fixedVersion": "1:6.18.20-20.229.amzn2023", "fix": "ALAS2023-2026-1596", "url": "https://patchblox.com/security/fix/linux/alas2023-2026-1596", "released": "2026-04-27T09:00:00Z" } ], "noFixYet": [], "dataAsOf": "2026-11-09T01:18:40Z", "attribution": { "text": "Data: Patchblox Patch Radar", "url": "https://patchblox.com/security/patch-radar", "terms": "https://patchblox.com/security/patch-radar/use-the-data" } }