Executive brief
A vulnerability in the Linux kernel's performance monitoring subsystem for PowerPC systems could allow a local user to crash the operating system. This occurs when the system attempts to record program activity for a process that is already in the process of shutting down. An exploit results in a kernel panic, leading to a complete system outage and loss of availability for all hosted services.
Technical details
A NULL pointer dereference exists in the PowerPC architecture-specific implementation of the perf subsystem. The vulnerability occurs in the perf_callchain_user function when it attempts to process a user callchain for a process whose memory management structure (current->mm) has already been released. This typically happens during process teardown when a profiling BPF program or perf event is triggered. An attacker with local access can trigger this condition to cause a kernel panic (Oops). The fix introduces a NULL check for current->mm before attempting to traverse the user callchain, ensuring the kernel handles released memory structures gracefully.
Affected products
- Linux Linux Kernel 2.6.32 to 6.18.19, 6.19 to 6.19.9, 7.0-rc1 to 7.0-rc3
Timeline
- 2026-03-09: patched: Initial patch authored by Viktor Malik
- 2026-05-08: disclosed: CVE published by kernel.org
- 2026-05-26: advisory: NIST/NVD analysis completed