Executive brief
A vulnerability was identified in the Linux kernel affecting systems running on AMD processors. A race condition in the performance monitoring unit (PMU) can cause the system to crash (General Protection Fault) when specific monitoring events are triggered. This could lead to a complete system denial of service, impacting availability and operational stability.
Technical details
A race condition exists in the Linux kernel's perf subsystem specifically for AMD architectures. The vulnerability occurs between the NMI handler (via x86_pmu_stop) and amd_pmu_enable_all(), where the event pointer `cpuc->events[idx]` can be set to NULL while still being accessed for enablement. This results in a null-pointer dereference and a General Protection Fault (GPF). The issue was identified by Syzkaller and is addressed by adding a NULL check before calling amd_pmu_enable_event(). The vulnerability is local in nature, requiring the ability to trigger performance monitoring events.
Affected products
- Linux Linux Kernel 6.12.0-rc1-syzk and earlier stable branches
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6 and earlier
Timeline
- 2024-10-08: disclosed: Initial patch authored
- 2026-01-02: patched: Patch committed to stable tree
- 2026-01-13: advisory: CVE published
References
- https://git.kernel.org/stable/c/43c2e5c2acaae50e99d1c20a5a46e367c442fb3b
- https://git.kernel.org/stable/c/49324a0c40f7e9bae1bd0362d23fc42232e14621
- https://git.kernel.org/stable/c/6e41d9ec8d7cc3f01b9ba785e05f0ebef8b3b37f
- https://git.kernel.org/stable/c/866cf36bfee4fba6a492d2dcc5133f857e3446b0
- https://git.kernel.org/stable/c/e1028fb38b328084bc683a4efb001c95d3108573
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html