Linux perf/x86/amd - general protection fault from a NULL event on enable: A subtle race lets cpuc

Impact

A subtle race lets cpuc->events[idx] become NULL on AMD machines, and enabling the event then takes a general protection fault, panicking the host. Same family as the other AMD perf races: the monitoring stack crashes the machine it is monitoring.

Who can reach it

Local, through perf event scheduling. Reachable by observability agents and by tenants where perf is permitted.

What to do

Distro kernel update plus reboot.

References

Related entries

• Apache CloudStack: unsanitized backup repository options inject OS commands onto the KVM hypervisor hostCVE-2026-47359 · Apache CloudStack NAS backup provider (addBackupRepository / updateBackupRepository)Unscored
• DMTF SPDM specification DSP0274 1.4 (FINISH transcript definition): A specification-level defect rather thanCVE-2026-61810 · DMTF SPDM specification DSP0274 1.4 (FINISH transcript definition)Unscored
• Linux x86/mm - broadcast TLB flush with PCID disabled: Booting with nopcid clears the PCID feature but broadcast TLBCVE-2026-64229 · Linux x86/mm - broadcast TLB flush with PCID disabledUnscored
• Linux crypto/ccp - SNP initialization on ioctl(SNP_COMMIT): The ccp driver initialised SNP from the SNP_COMMIT ioctlCVE-2026-64309 · Linux crypto/ccp - SNP initialization on ioctl(SNP_COMMIT)Unscored
• Linux iommu/amd - IRQ-unsafe locking in guest domain allocation: An IRQ-unsafe lock taken during AMD IOMMU guest domainCVE-2026-68347 · Linux iommu/amd - IRQ-unsafe locking in guest domain allocationUnscored
• Linux perf/x86/amd/core - Branch Sampling enabled from the SVM reload path: Branch Sampling and Last Branch RecordCVE-2026-72325 · Linux perf/x86/amd/core - Branch Sampling enabled from the SVM reload pathUnscored