CVE-2025-68798
Description
In the Linux kernel, the following vulnerability has been resolved:
perf/x86/amd: Check event before enable to avoid GPF
On AMD machines cpuc->events[idx] can become NULL in a subtle race condition with NMI->throttle->x86_pmu_stop().
Check event for NULL in amd_pmu_enable_all() before enable to avoid a GPF. This appears to be an AMD only issue.
Syzkaller reported a GPF in amd_pmu_enable_all.
INFO: NMI handler (perf_event_nmi_handler) took too long to run: 13.143 msecs Oops: general protection fault, probably for non-canonical address 0xdffffc0000000034: 0000 PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x00000000000001a0-0x00000000000001a7] CPU: 0 UID: 0 PID: 328415 Comm: repro_36674776 Not tainted 6.12.0-rc1-syzk RIP: 0010:x86_pmu_enable_event (arch/x86/events/perf_event.h:1195 arch/x86/events/core.c:1430) RSP: 0018:ffff888118009d60 EFLAGS: 00010012 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000034 RSI: 0000000000000000 RDI: 00000000000001a0 RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000002 R13: ffff88811802a440 R14: ffff88811802a240 R15: ffff8881132d8601 FS: 00007f097dfaa700(0000) GS:ffff888118000000(0000) GS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000200001c0 CR3: 0000000103d56000 CR4: 00000000000006f0 Call Trace:
amd_pmu_enable_all (arch/x86/events/amd/core.c:760 (discriminator 2)) x86_pmu_enable (arch/x86/events/core.c:1360) event_sched_out (kernel/events/core.c:1191 kernel/events/core.c:1186 kernel/events/core.c:2346) __perf_remove_from_context (kernel/events/core.c:2435) event_function (kernel/events/core.c:259) remote_function (kernel/events/core.c:92 (discriminator 1) kernel/events/core.c:72 (discriminator 1)) __flush_smp_call_function_queue (./arch/x86/include/asm/jump_label.h:27 ./include/linux/jump_label.h:207 ./include/trace/events/csd.h:64 kernel/smp.c:135 kernel/smp.c:540) __sysvec_call_function_single (./arch/x86/include/asm/jump_label.h:27 ./include/linux/jump_label.h:207 ./arch/x86/include/asm/trace/irq_vectors.h:99 arch/x86/kernel/smp.c:272) sysvec_call_function_single (arch/x86/kernel/smp.c:266 (discriminator 47) arch/x86/kernel/smp.c:266 (discriminator 47))
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
A race condition in AMD's PMU driver can cause a NULL pointer dereference (GPF) when enabling perf events, leading to a kernel crash.
Vulnerability
Description
In the Linux kernel's AMD PMU driver (perf/x86/amd), a race condition exists where the event pointer (cpuc->events[idx]) can become NULL during concurrent NMI handling and event stopping. The function amd_pmu_enable_all() calls x86_pmu_enable_event() without validating that the event pointer is non-NULL, resulting in a general protection fault (GPF) when dereferencing the NULL pointer. [1]
Exploitation
Scenario
The race is triggered by local users through the perf subsystem, specifically during interactions between NMI handlers, event throttling, and x86_pmu_stop(). Syzkaller reproduced the issue, demonstrating a GPF with KASAN reporting a null-ptr-deref at address 0x1a0 in the x86_pmu_enable_event function. An attacker with local access and the ability to create perf events can potentially exploit this race to cause a kernel crash.
Impact
Successful exploitation leads to a GPF, which crashes the kernel and causes a denial of service. The bug can render the system unstable or unresponsive, but no privilege escalation or data leakage has been identified.
Mitigation
The fix has been applied in Linux kernel commit [1] and backported to stable branches [2][3]. Users should update their kernels to include the patch that adds a NULL check before enabling events in amd_pmu_enable_all(). This issue is specific to AMD systems.
AI Insight generated on May 19, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
5- git.kernel.org/stable/c/43c2e5c2acaae50e99d1c20a5a46e367c442fb3bnvd
- git.kernel.org/stable/c/49324a0c40f7e9bae1bd0362d23fc42232e14621nvd
- git.kernel.org/stable/c/6e41d9ec8d7cc3f01b9ba785e05f0ebef8b3b37fnvd
- git.kernel.org/stable/c/866cf36bfee4fba6a492d2dcc5133f857e3446b0nvd
- git.kernel.org/stable/c/e1028fb38b328084bc683a4efb001c95d3108573nvd
News mentions
0No linked articles in our index yet.