CVE-2026-23435 Linux CVE debrief

Who should care

System administrators and users of Linux kernel versions 6.17.13 to 6.18.19, 6.19.1 to 6.19.10, and 7.0 rc1 to rc7 should be aware of this vulnerability. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. They should also plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Technical summary

The vulnerability is caused by a commit that moved the cpuc->events[idx] assignment out of x86_pmu_start() and into step 2 of x86_pmu_enable(), after the PERF_HES_ARCH check. This broke the unthrottle path, leading to a NULL pointer dereference when a PMC overflow NMI fires. The event that should occupy events[2] was found in event_list[2] with hw.idx=2 and hw.state=0x0, confirming x86_pmu_start() had run but events[2] was never populated. The root cause is related to the race sequence involving the throttle-then-reschedule sequence.

Defensive priority

High

Recommended defensive actions

• Apply patches from Linux kernel versions 6.18.20, 6.19.11, or 7.0 rc8 and later.
• Update Linux kernel to a version that includes the fix.
• Monitor system logs for potential exploitation attempts.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability was discovered on an AMD EPYC system with a NULL pointer dereference in the PMU NMI handler. The faulting instruction was `cmpq $0x0, 0x198(%rdi)` with RDI=0, corresponding to the `if (unlikely(!hwc->event_base))` check in x86_perf_event_update() where hwc = &event->hw and event is NULL. The event that should occupy events[2] was found in event_list[2] with hw.idx=2 and hw.state=0x0, confirming x86_pmu_start() had run but events[2] was never populated.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.