CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain
In the Linux kernel, the following vulnerability has been resolved:
powerpc, perf: Check that current->mm is alive before getting user callchain
It may happen that mm is already released, which leads to kernel panic. This adds the NULL check for current->mm, similarly to commit 20afc60f892d ("x86, perf: Check that current->mm is alive before getting user callchain").
I was getting this panic when running a profiling BPF program (profile.py from bcc-tools):
[26215.051935] Kernel attempted to read user page (588) - exploit attempt? (uid: 0) [26215.051950] BUG: Kernel NULL pointer dereference on read at 0x00000588 [26215.051952] Faulting instruction address: 0xc00000000020fac0 [26215.051957] Oops: Kernel access of bad area, sig: 11 [#1] [...] [26215.052049] Call Trace: [26215.052050] [c000000061da6d30] [c00000000020fc10] perfcallchainuser64+0x2d0/0x490 (unreliable) [26215.052054] [c000000061da6dc0] [c00000000020f92c] perfcallchainuser+0x1c/0x30 [26215.052057] [c000000061da6de0] [c0000000005ab2a0] getperfcallchain+0x100/0x360 [26215.052063] [c000000061da6e70] [c000000000573bc8] bpfgetstackid+0x88/0xf0 [26215.052067] [c000000061da6ea0] [c008000000042258] bpfprog16d4ab9ab662f669doperfevent+0xf8/0x274 [...]
In addition, move storing the top-level stack entry to generic perfcallchainuser to make sure the top-evel entry is always captured, even if current->mm is NULL.
[Maddy: fixed message to avoid checkpatch format style error]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.19 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.19.9 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.19.10-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.15-1Fixed in 7.3.4-1
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems running the Linux kernel on PowerPC that use perf user callchain collection are exposed. The reported failure occurred while running a profiling BPF program, specifically profile.py from bcc-tools.
What access does an attacker or triggering user need?
The CVSS vector indicates local access with low privileges required and no user interaction. The provided report shows the panic occurred during BPF-based profiling, but does not establish which BPF permissions or configurations are required in every environment.
How can I tell whether this has already affected a system?
Look for a kernel panic or NULL-pointer dereference with perf_callchain_user_64, perf_callchain_user, get_perf_callchain, and bpf_get_stackid in the call trace. The reported fault included an attempted read of user page 0x588 and a NULL-pointer read at 0x00000588.
What should be done if the issue is identified?
Apply an available patch. The fix adds a NULL check for current->mm before retrieving the user callchain, preventing the panic when the memory context has already been released.