Executive brief
A vulnerability in the Linux kernel's performance monitoring subsystem can cause a complete system crash (kernel panic). This occurs when the system attempts to track hardware performance metrics on certain processors, such as AMD EPYC, and encounters a specific timing issue that leads to a memory error. An attacker or a malfunctioning application could trigger this crash, resulting in a denial of service and impacting system availability.
Technical details
A NULL pointer dereference exists in the x86 PMU NMI handler due to a race condition in how performance events are managed. The root cause is a regression where the assignment of the event pointer to the CPU context was moved to a later stage in x86_pmu_enable(), specifically after a PERF_HES_ARCH check. This causes paths that call pmu->start() without going through x86_pmu_enable()—such as the unthrottle path—to set the active mask without populating the event pointer. When a subsequent PMC overflow NMI occurs, the handler attempts to dereference the NULL event pointer, causing a kernel panic. The fix involves moving the event pointer assignment earlier in the x86_pmu_enable() function.
Affected products
- Linux Linux Kernel All versions prior to the March 2026 patches
Timeline
- 2026-03-10: other: Vulnerability fixed in source code by Breno Leitao
- 2026-03-25: patched: Patches committed to stable kernel branches
- 2026-04-03: disclosed: CVE published to NVD