Linux Kernel CVE-2026-43416

Exploitation requires all of the following: (1) PowerPC (ppc64/ppc64le) architecture - this code path does not exist on x86 or ARM; (2) local system access with privileges to execute BPF programs (PR:L per CVSS - requires CAP_BPF, CAP_SYS_ADMIN, or a system where unprivileged BPF is enabled via kernel.unprivileged_bpf_disabled=0); (3) execution of a perf stack-sampling BPF program (e.g., profile.py from bcc-tools or equivalent) that invokes bpf_get_stackid(); (4) a concurrent process exit that releases current->mm at the moment a perf sample is collected - a timing race that may require repeated attempts. Limiting factors: architecture restriction to PowerPC eliminates the vast majority of Linux deployments; BPF privilege requirement prevents anonymous or low-trust exploitation; the race condition with mm release adds non-determinism. There is no network-facing attack vector; remote exploitation is not possible.

CVSS 5.5 medium (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) accurately characterizes this as a local, low-complexity denial-of-service with no confidentiality or integrity impact. The local attack vector (AV:L) and low privileges required (PR:L, typically CAP_BPF or CAP_SYS_ADMIN) meaningfully limit the attack surface compared to network-facing vulnerabilities. EPSS at 0.02% (4th percentile) is consistent with a niche, architecture-specific kernel DoS that requires specific hardware and a timing race condition. No KEV listing confirms no known active exploitation campaign. The absence of a public POC further deprioritizes this. Real-world priority is low for most organizations; the primary concern is PowerPC-specific deployments (IBM POWER servers, OpenPOWER systems) where untrusted users can invoke BPF profiling. The race condition (AC:L is arguably optimistic - triggering the exact mm release timing may require repeated attempts) may make reliable exploitation harder than CVSS suggests, though CVSS rates it low complexity.

A local user with BPF execution rights (e.g., CAP_BPF or system with unprivileged_bpf_disabled=0) on a PowerPC Linux server runs a stack-sampling BPF program such as bcc-tools' profile.py while other processes are concurrently exiting. When a perf sample fires against a thread whose mm has already been released (set to NULL during exit), perf_callchain_user_64() dereferences the NULL pointer, triggering a kernel oops with sig 11 and crashing the system. No public POC beyond the bcc-tools reproduction method described in the CVE itself is known.