CVE-2026-23435: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23435 is a NULL pointer dereference vulnerability (CWE-476) in the Linux kernel's x86 Performance Monitoring Unit (PMU) NMI handler, specifically within the perf/x86 subsystem. The flaw was published on April 3, 2026, and affects Linux kernel versions 6.17.13 through pre-6.18, 6.18.2 through pre-6.18.20, 6.19 through pre-6.19.10, and 7.0-rc1 through 7.0-rc7. It carries a CVSS v3.1 base score of 5.5 (Medium), reflecting a local attack vector with low privileges required and high availability impact (Feedly).

The root cause is a race condition in x86_pmu_enable() where the cpuc->events[hwc->idx] pointer assignment occurs too late — after the PERF_HES_ARCH check — leaving the events[] array entry NULL while the corresponding active_mask bit is already set (CWE-476). The exploitation sequence is: (1) perf events overflow and trigger group throttle, stopping all events; (2) x86_pmu_enable() runs due to scheduling activity, rescheduling stopped events and clearing stale event pointers; (3) the timer tick unthrottles the group, setting active_mask bits but leaving events[] pointers NULL; (4) a PMC overflow NMI fires, and the handler dereferences the NULL event pointer in x86_perf_event_update(), causing a kernel panic. The crash manifests as BUG: kernel NULL pointer dereference, address: 0000000000000198 with the faulting instruction cmpq $0x0, 0x198(%rdi) where RDI=0. The fix moves the cpuc->events[hwc->idx] assignment earlier in x86_pmu_enable(), before the PERF_HES_ARCH check (Feedly, Kernel Patch 1).

Successful triggering of this vulnerability causes a kernel NULL pointer dereference, resulting in an immediate system crash (kernel panic) and unexpected reboot, directly impacting availability. There is no confidentiality or integrity impact. AMD EPYC production systems running perf-intensive workloads are most susceptible, and repeated crashes can cause significant service disruption in high-performance computing or server environments (Feedly).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation as of the time of reporting. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with at least low-privilege user rights and the ability to trigger perf event throttling and rescheduling, limiting the practical attack surface (Feedly).

1. Gain local access: Obtain a local user account on a vulnerable AMD EPYC system running an affected Linux kernel version (6.17.13–pre-6.18, 6.18.2–pre-6.18.20, 6.19–pre-6.19.10, or 7.0-rc1 through 7.0-rc7).
2. Initiate perf event monitoring: Use the perf tool or perf_event_open() syscall to create and start multiple hardware performance counter events, targeting PMU counters on the system.
3. Trigger event overflow and throttle: Generate a high-frequency workload that causes perf events to overflow rapidly, triggering the kernel's group throttle mechanism which stops all events in the group.
4. Force event rescheduling: Cause scheduling activity (e.g., context switches) that invokes x86_pmu_enable(), which reschedules stopped events and clears stale events[] pointers before the new pointer is assigned.
5. Trigger unthrottle: Allow the timer tick to unthrottle the event group, which sets active_mask bits for counters whose events[] entries remain NULL due to the race condition.
6. Induce NMI crash: A subsequent PMC overflow NMI fires; the amd_pmu_v2_handle_irq() handler calls x86_perf_event_update() with a NULL event pointer, causing a kernel NULL pointer dereference and system crash (Feedly).

• Logs: Kernel panic messages containing BUG: kernel NULL pointer dereference, address: 0000000000000198 in /var/log/kern.log or system journal.
• Logs: Stack traces referencing x86_perf_event_update+0xc/0xa0, amd_pmu_v2_handle_irq, and perf_event_nmi_handler in crash dumps or kernel logs.
• Logs: Unexpected system reboots logged in /var/log/syslog or IPMI/BMC event logs, particularly on AMD EPYC hosts running perf workloads.
• File System: vmcore crash dump files (e.g., /var/crash/) showing cpuc->active_mask and cpuc->events[] mismatch on the affected CPU.
• Process: Unusual or repeated invocations of perf or applications using perf_event_open() syscall immediately preceding system crashes (Feedly).

Update the Linux kernel to a patched version: 6.18.20 or later, 6.19.10 or later, or a subsequent stable release. Three upstream patches have been committed to the stable kernel tree addressing this issue. For systems that cannot be immediately patched, mitigations include disabling perf event monitoring or avoiding workloads that trigger high-frequency PMU event throttling and rescheduling, particularly on AMD EPYC systems. Amazon Linux 2023 users should apply the update referenced in ALAS2023-2026-1596 (Feedly, Amazon Advisory).

The vulnerability was announced via the official Linux kernel CVE mailing list (linux-cve-announce) on April 3, 2026. A Tenable Nessus detection plugin (ID 311340) was published to identify affected systems. No significant broader media coverage or notable researcher commentary beyond standard kernel security channels has been observed (Feedly, Tenable).