{ "document": { "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this portal to enhance access to its information and vulnerabilities. The use of this information is subject to the following terms and conditions:\n\nThe vulnerabilities disclosed in this portal are gathered by NCSC-NL from a variety of open sources, which the user can retrieve from other platforms. NCSC-NL makes every reasonable effort to ensure that the content of this portal is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or real-time keeping up-to-date. NCSC-NL does not control nor guarantee the accuracy, relevance, timeliness or completeness of information obtained from these external sources. The vulnerabilities disclosed in this portal are intended solely for the convenience of professional parties to take appropriate measures to manage the risks posed to the cybersecurity. No rights can be derived from the information provided therein.\n\nNCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of the vulnerabilities disclosed in this portal. This includes damage resulting from the inaccuracy of incompleteness of the information contained in it.\nThe information on this page is subject to Dutch law. All disputes related to or arising from the use of this portal regarding the disclosure of vulnerabilities will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "National Cyber Security Centre", "namespace": "https://www.ncsc.nl/" }, "title": "CVE-2026-23435", "tracking": { "current_release_date": "2026-04-03T16:52:44.662281Z", "generator": { "date": "2026-02-17T15:00:00Z", "engine": { "name": "V.E.L.M.A", "version": "1.7" } }, "id": "CVE-2026-23435", "initial_release_date": "2026-04-03T15:38:54.730627Z", "revision_history": [ { "date": "2026-04-03T15:38:54.730627Z", "number": "1", "summary": "CVE created.| Source created.| CVE status created. (valid)| Description created for source.| Products created (4).| Products connected (5).| References created (3)." }, { "date": "2026-04-03T15:38:58.811626Z", "number": "2", "summary": "NCSC Score created." }, { "date": "2026-04-03T16:48:08.068542Z", "number": "3", "summary": "Source created.| CVE status created. (valid)| Description created for source.| References created (3)." } ], "status": "interim", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:git/6b089028bff1f2ff9e0c62b8f1faca1a620e5d6e|<886fa869153917d902784098922defa20c3a2fe5", "product": { "name": "vers:git/6b089028bff1f2ff9e0c62b8f1faca1a620e5d6e|<886fa869153917d902784098922defa20c3a2fe5", "product_id": "CSAFPID-5992173" } }, { "category": "product_version_range", "name": "vers:git/7e772a93eb61cb6265bdd1c5bde17d0f2718b452|<8d5fae6011260de209aaf231120e8146b14bc8e0", "product": { "name": "vers:git/7e772a93eb61cb6265bdd1c5bde17d0f2718b452|<8d5fae6011260de209aaf231120e8146b14bc8e0", "product_id": "CSAFPID-5992175" } }, { "category": "product_version_range", "name": "vers:git/7e772a93eb61cb6265bdd1c5bde17d0f2718b452|\n amd_pmu_v2_handle_irq+0x1a6/0x390\n perf_event_nmi_handler+0x24/0x40\n\nThe faulting instruction is `cmpq $0x0, 0x198(%rdi)` with RDI=0,\ncorresponding to the `if (unlikely(!hwc->event_base))` check in\nx86_perf_event_update() where hwc = &event->hw and event is NULL.\n\ndrgn inspection of the vmcore on CPU 106 showed a mismatch between\ncpuc->active_mask and cpuc->events[]:\n\n active_mask: 0x1e (bits 1, 2, 3, 4)\n events[1]: 0xff1100136cbd4f38 (valid)\n events[2]: 0x0 (NULL, but active_mask bit 2 set)\n events[3]: 0xff1100076fd2cf38 (valid)\n events[4]: 0xff1100079e990a90 (valid)\n\nThe event that should occupy events[2] was found in event_list[2]\nwith hw.idx=2 and hw.state=0x0, confirming x86_pmu_start() had run\n(which clears hw.state and sets active_mask) but events[2] was\nnever populated.\n\nAnother event (event_list[0]) had hw.state=0x7 (STOPPED|UPTODATE|ARCH),\nshowing it was stopped when the PMU rescheduled events, confirming the\nthrottle-then-reschedule sequence occurred.\n\nThe root cause is commit 7e772a93eb61 (\"perf/x86: Fix NULL event access\nand potential PEBS record loss\") which moved the cpuc->events[idx]\nassignment out of x86_pmu_start() and into step 2 of x86_pmu_enable(),\nafter the PERF_HES_ARCH check. This broke any path that calls\npmu->start() without going through x86_pmu_enable() -- specifically\nthe unthrottle path:\n\n perf_adjust_freq_unthr_events()\n -> perf_event_unthrottle_group()\n -> perf_event_unthrottle()\n -> event->pmu->start(event, 0)\n -> x86_pmu_start() // sets active_mask but not events[]\n\nThe race sequence is:\n\n 1. A group of perf events overflows, triggering group throttle via\n perf_event_throttle_group(). All events are stopped: active_mask\n bits cleared, events[] preserved (x86_pmu_stop no longer clears\n events[] after commit 7e772a93eb61).\n\n 2. While still throttled (PERF_HES_STOPPED), x86_pmu_enable() runs\n due to other scheduling activity. Stopped events that need to\n move counters get PERF_HES_ARCH set and events[old_idx] cleared.\n In step 2 of x86_pmu_enable(), PERF_HES_ARCH causes these events\n to be skipped -- events[new_idx] is never set.\n\n 3. The timer tick unthrottles the group via pmu->start(). Since\n commit 7e772a93eb61 removed the events[] assignment from\n x86_pmu_start(), active_mask[new_idx] is set but events[new_idx]\n remains NULL.\n\n 4. A PMC overflow NMI fires. The handler iterates active counters,\n finds active_mask[2] set, reads events[2] which is NULL, and\n crashes dereferencing it.\n\nMove the cpuc->events[hwc->idx] assignment in x86_pmu_enable() to\nbefore the PERF_HES_ARCH check, so that events[] is populated even\nfor events that are not immediately started. This ensures the\nunthrottle path via pmu->start() always finds a valid event pointer.", "title": "cveprojectv5 - https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/23xxx/CVE-2026-23435.json" }, { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/x86: Move event pointer setup earlier in x86_pmu_enable()\n\nA production AMD EPYC system crashed with a NULL pointer dereference\nin the PMU NMI handler:\n\n BUG: kernel NULL pointer dereference, address: 0000000000000198\n RIP: x86_perf_event_update+0xc/0xa0\n Call Trace:\n \n amd_pmu_v2_handle_irq+0x1a6/0x390\n perf_event_nmi_handler+0x24/0x40\n\nThe faulting instruction is `cmpq $0x0, 0x198(%rdi)` with RDI=0,\ncorresponding to the `if (unlikely(!hwc->event_base))` check in\nx86_perf_event_update() where hwc = &event->hw and event is NULL.\n\ndrgn inspection of the vmcore on CPU 106 showed a mismatch between\ncpuc->active_mask and cpuc->events[]:\n\n active_mask: 0x1e (bits 1, 2, 3, 4)\n events[1]: 0xff1100136cbd4f38 (valid)\n events[2]: 0x0 (NULL, but active_mask bit 2 set)\n events[3]: 0xff1100076fd2cf38 (valid)\n events[4]: 0xff1100079e990a90 (valid)\n\nThe event that should occupy events[2] was found in event_list[2]\nwith hw.idx=2 and hw.state=0x0, confirming x86_pmu_start() had run\n(which clears hw.state and sets active_mask) but events[2] was\nnever populated.\n\nAnother event (event_list[0]) had hw.state=0x7 (STOPPED|UPTODATE|ARCH),\nshowing it was stopped when the PMU rescheduled events, confirming the\nthrottle-then-reschedule sequence occurred.\n\nThe root cause is commit 7e772a93eb61 (\"perf/x86: Fix NULL event access\nand potential PEBS record loss\") which moved the cpuc->events[idx]\nassignment out of x86_pmu_start() and into step 2 of x86_pmu_enable(),\nafter the PERF_HES_ARCH check. This broke any path that calls\npmu->start() without going through x86_pmu_enable() -- specifically\nthe unthrottle path:\n\n perf_adjust_freq_unthr_events()\n -> perf_event_unthrottle_group()\n -> perf_event_unthrottle()\n -> event->pmu->start(event, 0)\n -> x86_pmu_start() // sets active_mask but not events[]\n\nThe race sequence is:\n\n 1. A group of perf events overflows, triggering group throttle via\n perf_event_throttle_group(). All events are stopped: active_mask\n bits cleared, events[] preserved (x86_pmu_stop no longer clears\n events[] after commit 7e772a93eb61).\n\n 2. While still throttled (PERF_HES_STOPPED), x86_pmu_enable() runs\n due to other scheduling activity. Stopped events that need to\n move counters get PERF_HES_ARCH set and events[old_idx] cleared.\n In step 2 of x86_pmu_enable(), PERF_HES_ARCH causes these events\n to be skipped -- events[new_idx] is never set.\n\n 3. The timer tick unthrottles the group via pmu->start(). Since\n commit 7e772a93eb61 removed the events[] assignment from\n x86_pmu_start(), active_mask[new_idx] is set but events[new_idx]\n remains NULL.\n\n 4. A PMC overflow NMI fires. The handler iterates active counters,\n finds active_mask[2] set, reads events[2] which is NULL, and\n crashes dereferencing it.\n\nMove the cpuc->events[hwc->idx] assignment in x86_pmu_enable() to\nbefore the PERF_HES_ARCH check, so that events[] is populated even\nfor events that are not immediately started. This ensures the\nunthrottle path via pmu->start() always finds a valid event pointer.", "title": "nvd - https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-23435" }, { "category": "other", "text": "4.1", "title": "NCSC Score" }, { "category": "other", "text": "The value of the most recent CVSS (V3) score, Is related to a product by vendor Linux", "title": "NCSC Score top decreasing factors" } ], "product_status": { "known_affected": [ "CSAFPID-5669166", "CSAFPID-5992173", "CSAFPID-5992174", "CSAFPID-5992175", "CSAFPID-5992176" ], "known_not_affected": [ "CSAFPID-5669167", "CSAFPID-5905005", "CSAFPID-5905006", "CSAFPID-5905027" ] }, "references": [ { "category": "external", "summary": "Source - cveprojectv5", "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/23xxx/CVE-2026-23435.json" }, { "category": "external", "summary": "Source - nvd", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-23435" }, { "category": "external", "summary": "Reference - cveprojectv5; nvd", "url": "https://git.kernel.org/stable/c/886fa869153917d902784098922defa20c3a2fe5" }, { "category": "external", "summary": "Reference - cveprojectv5; nvd", "url": "https://git.kernel.org/stable/c/c1dd1e2b722d3f1f2e4977dad8d1be78fdfb30cb" }, { "category": "external", "summary": "Reference - cveprojectv5; nvd", "url": "https://git.kernel.org/stable/c/8d5fae6011260de209aaf231120e8146b14bc8e0" } ], "title": "CVE-2026-23435" } ] }