PT-2026-30130 · Linux+1 · Linux Kernel+1

Published 2026-04-03 · Updated 2026-04-03 · CVE-2026-23435

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel contained a flaw in the perf/x86 subsystem related to event pointer handling within the x86 pmu enable() function. A NULL pointer dereference could occur in the PMU NMI handler, leading to a kernel crash. This was triggered by a mismatch between the active mask and the events array, specifically when an event was stopped and then rescheduled. The root cause was identified as a code change that moved the assignment of event pointers, introducing a race condition where events could be marked as active without a valid pointer being assigned. A production AMD EPYC system experienced this issue, resulting in a kernel crash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2026-23435

Affected Products

Amd Epyc™

Linux Kernel

References · 11

• https://osv.dev/vulnerability/UBUNTU-CVE-2026-23435 · Vendor Advisory
• https://git.kernel.org/stable/c/886fa869153917d902784098922defa20c3a2fe5 · Patch
• https://ubuntu.com/security/CVE-2026-23435 · Vendor Advisory
• https://git.kernel.org/stable/c/8d5fae6011260de209aaf231120e8146b14bc8e0 · Patch
• https://cve.org/CVERecord?id=CVE-2026-23435 · Security Note
• https://git.kernel.org/stable/c/c1dd1e2b722d3f1f2e4977dad8d1be78fdfb30cb · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-23435 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-23435 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-23435 · Vendor Advisory
• https://git.kernel.org/linus/8d5fae6011260de209aaf231120e8146b14bc8e0 · Note
• https://twitter.com/CVEnew/status/2040111897761169428 · Twitter Post