Junglewise Threat Intelligence

CVE-2026-23435: Linux Kernel NULL pointer dereference in x86 PMU NMI handler

CVE-2026-23435 · Severity: medium · CVSS 5.5 · Published 2026-04-03

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's performance monitoring subsystem can cause a complete system crash (kernel panic). This occurs when the system attempts to track hardware performance metrics on certain processors, such as AMD EPYC, and encounters a specific timing issue that leads to a memory error. An attacker or a malfunctioning application could trigger this crash, resulting in a denial of service and impacting system availability.

Technical details

A NULL pointer dereference exists in the x86 PMU NMI handler due to a race condition in how performance events are managed. The root cause is a regression where the assignment of the event pointer to the CPU context was moved to a later stage in x86_pmu_enable(), specifically after a PERF_HES_ARCH check. This causes paths that call pmu->start() without going through x86_pmu_enable()—such as the unthrottle path—to set the active mask without populating the event pointer. When a subsequent PMC overflow NMI occurs, the handler attempts to dereference the NULL event pointer, causing a kernel panic. The fix involves moving the event pointer assignment earlier in the x86_pmu_enable() function.

Affected products

  • Linux Linux Kernel All versions prior to the March 2026 patches

Timeline

  • 2026-03-10: other: Vulnerability fixed in source code by Breno Leitao
  • 2026-03-25: patched: Patches committed to stable kernel branches
  • 2026-04-03: disclosed: CVE published to NVD

References

Related threats