CVE-2026-43416 Overview
CVE-2026-43416 is a NULL pointer dereference vulnerability in the Linux kernel's PowerPC performance monitoring (perf) subsystem. The flaw resides in perf_callchain_user_64, which captures user-space callchains for profiling. When current->mm has already been released, the kernel attempts to read from a freed memory descriptor, triggering an Oops at address 0x00000588. The issue was observed while running a BPF profiling program (profile.py from bcc-tools). The fix adds a NULL check for current->mm, mirroring the earlier x86 fix in commit 20afc60f892d, and moves storage of the top-level stack entry into the generic perf_callchain_user path.
Critical Impact
A local user running perf-based BPF profiling on PowerPC systems can trigger a kernel NULL pointer dereference, resulting in a kernel panic and denial of service.
Affected Products
- Linux kernel on PowerPC (ppc64) architecture
- Kernel builds with CONFIG_PERF_EVENTS and BPF profiling support
- Distributions shipping affected kernel versions prior to the upstream stable patches
Discovery Timeline
- 2026-05-08 - CVE-2026-43416 published to NVD
- 2026-05-12 - Last updated in NVD database
Technical Details for CVE-2026-43416
Vulnerability Analysis
The Linux kernel perf subsystem collects user-space callchains so profilers can attribute samples back to source code. On PowerPC, the function perf_callchain_user_64 walks the user stack of the currently running task using current->mm to access the process address space.
When a task is in the process of exiting, its mm_struct may have already been released. If a perf event fires in that narrow window — for example, from a BPF program invoking bpf_get_stackid — perf_callchain_user_64 dereferences a freed or NULL mm pointer. The kernel logs a fault at offset 0x588 within the mm_struct layout and panics with BUG: Kernel NULL pointer dereference on read at 0x00000588.
The vulnerability is classified as a NULL pointer dereference leading to denial of service [CWE-476]. The bug is reachable from any context that can attach a BPF profiling program to a perf event, which on many systems requires CAP_PERFMON or CAP_SYS_ADMIN.
Root Cause
The PowerPC implementation of perf_callchain_user_64 did not validate current->mm before dereferencing it. Tasks that have already exited exit_mm() retain a stale or NULL mm pointer while perf callchain sampling is still possible.
Attack Vector
Exploitation requires local access and the ability to run a perf-based profiler or attach a BPF program to a perf event. The reporter triggered the panic using the bcc-tools profile.py script, which attaches a BPF program calling bpf_get_stackid against a perf event source. No code execution or privilege escalation is demonstrated — the impact is a kernel panic and host denial of service.
A call trace from the reported crash:
perf_callchain_user_64+0x2d0/0x490
perf_callchain_user+0x1c/0x30
get_perf_callchain+0x100/0x360
bpf_get_stackid+0x88/0xf0
bpf_prog_..._do_perf_event+0xf8/0x274
Detection Methods for CVE-2026-43416
Indicators of Compromise
- Kernel log entries containing BUG: Kernel NULL pointer dereference on read at 0x00000588 on PowerPC hosts
- Oops messages referencing perf_callchain_user_64 in the faulting instruction trace
- Unexpected kernel panics correlated with execution of bcc-tools, perf record, or BPF profiling agents
Detection Strategies
- Query running kernel versions across PowerPC fleets and compare against the patched commits 7e5f60b8cfc0, 98074e16742a, and e9bbfb4bfa86.
- Monitor /var/log/kern.log, dmesg, and journalctl -k for Oops signatures referencing perf callchain functions.
- Audit which workloads load BPF programs that attach to perf events on ppc64 systems.
Monitoring Recommendations
- Forward kernel ring buffer events to a centralized logging or SIEM pipeline to correlate panics with profiler activity.
- Alert on repeated kernel Oops events from the same host, which may indicate ongoing triggering of the bug.
- Track usage of CAP_PERFMON and CAP_SYS_ADMIN grants to non-administrative service accounts.
How to Mitigate CVE-2026-43416
Immediate Actions Required
- Apply the upstream Linux stable kernel updates that include the current->mm NULL check in perf_callchain_user_64.
- Identify PowerPC hosts running profiling or observability stacks (bcc-tools, bpftrace, perf) and prioritize them for patching.
- Restrict BPF and perf capabilities on production hosts to administrators only.
Patch Information
The fix is committed upstream and backported via the Linux stable tree. Relevant commits: 7e5f60b8cfc0, 98074e16742a, and e9bbfb4bfa86. The patch adds a NULL check for current->mm and moves the top-level stack entry storage into the generic perf_callchain_user path so it is always captured.
Workarounds
- Disable or avoid running BPF stack-id profiling tools (profile.py, stackcount, similar bcc-tools) on unpatched PowerPC kernels.
- Lower kernel.perf_event_paranoid permissions and restrict CAP_PERFMON/CAP_SYS_ADMIN to trusted users only.
- Disable unprivileged BPF by setting kernel.unprivileged_bpf_disabled=1 to reduce the attack surface.
# Restrict perf and BPF access on unpatched PowerPC hosts
sysctl -w kernel.perf_event_paranoid=3
sysctl -w kernel.unprivileged_bpf_disabled=1
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
