CVE-2026-98477 - Vulnerability Details

- perf/core: Fix NULL pmu_ctx passed to pmu->sched_task()

Description

In the Linux kernel, the following vulnerability has been resolved:

perf/core: Fix NULL pmu_ctx passed to pmu->sched_task()

perf_pmu_sched_task() returns early when cpuctx->task_ctx is set, and
cpc->task_epc is only non-NULL while a task context is scheduled in on
this CPU. __perf_pmu_sched_task() therefore always passes NULL:

Unable to handle kernel NULL pointer dereference at virtual address 00
pc : armv8pmu_sched_task+0x14/0x50
Call trace:
armv8pmu_sched_task+0x14/0x50 (P)
perf_pmu_sched_task+0xac/0x108
__perf_event_task_sched_out+0x6c/0xe0

Pass &cpc->epc instead, the CPU-wide context for this PMU, which the
function already dereferences a few lines up to find pmu.

armv8pmu_sched_task() is the only in-tree implementation that
dereferences the argument, and it only reads ->pmu, so the oops needs
BRBE, added in v6.17.

Published: 2026-10-18

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

In the Linux kernel, the perf subsystem incorrectly passes a NULL pmu_ctx to pmu->sched_task(), causing a null pointer dereference that can trigger a kernel oops. This is a classic NULL pointer dereference (CWE‑476). The result is a kernel panic which can lead to denial of service by crashing the system.

Affected Systems

Systems using a Linux kernel that predates the patch that addresses this flaw are affected. The vulnerability exists in all kernel releases that do not include the 6.17 branch-race-bound-enforcer (BRBE) update, so any older release may be vulnerable.

Risk and Exploitability

The EPSS score of < 1% indicates a very low exploitation probability, and the vulnerability is not listed in KEV. The CVSS score of 5.5 points to moderate severity. Based on the description, it is inferred that an attacker would need local or privileged access to manipulate perf scheduling and trigger a kernel crash. The fix introduced a BRBE check in v6.17 to harden the scheduling path. Without the patch, a denial‑of‑service outcome remains possible, though exploitation would require sufficient access to the scheduling path.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`bd27568117664b8b3e259721393df420ed51f57b`	affected	< 98181f9721f75f1a544dc563b0d8fed1d5c398d5
`bd27568117664b8b3e259721393df420ed51f57b`	affected	< b5409311b606d536cc485f3706c242c2afa93edb
`bd27568117664b8b3e259721393df420ed51f57b`	affected	< 249a2bd87a0e57dc28f36e992807edc9cae309b5
`bd27568117664b8b3e259721393df420ed51f57b`	affected	< ec15f6a50183fc01f470af74ad49900fb3731fca
`bd27568117664b8b3e259721393df420ed51f57b`	affected	< 36bb85cf36cab15fb611cb44b78a5df06e4e69a2

Linux

affected

Version	Status	Constraints
`6.2`	affected	—
`0`	unaffected	< 6.2
`6.6.160`	unaffected	≤ 6.6.*
`6.12.112`	unaffected	≤ 6.12.*
`6.18.55`	unaffected	≤ 6.18.*
`7.2.9`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[bd27568117664b8b3e259721393df420ed51f57b,b5409311b606d536cc485f3706c242c2afa93edb)`	affected	code_commit	—
`[bd27568117664b8b3e259721393df420ed51f57b,249a2bd87a0e57dc28f36e992807edc9cae309b5)`	affected	code_commit	—
`[bd27568117664b8b3e259721393df420ed51f57b,ec15f6a50183fc01f470af74ad49900fb3731fca)`	affected	code_commit	—
`[bd27568117664b8b3e259721393df420ed51f57b,36bb85cf36cab15fb611cb44b78a5df06e4e69a2)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.2`	affected	generic	—
`[0,6.2)`	unaffected	generic	—
`[6.12.112,6.12.*]`	unaffected	generic	—
`[6.18.55,6.18.*]`	unaffected	generic	—
`[7.2.9,7.2.*]`	unaffected	generic	—
`[7.3-rc5,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update to a Linux kernel version that includes the fix for the perf PMU null pointer dereference (for example, kernel v6.17 or later).
Enable the BRBE hardening option so that branch race conditions are protected when scheduling perf tasks.
If an immediate kernel upgrade is not possible, restrict or disable the perf PMU feature on critical CPUs, for example by setting kernel.perf_event_paranoid to 2 or by removing the PMU configuration from the kernel build.

Generated by OpenCVE AI on October 22, 2026 at 23:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4850-1	linux-6.12 security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00168.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98477.mbox
https://git.kernel.org/stable/c/249a2bd87a0e57dc28f36e992807edc9cae309b5
https://git.kernel.org/stable/c/36bb85cf36cab15fb611cb44b78a5df06e4e69a2
https://git.kernel.org/stable/c/98181f9721f75f1a544dc563b0d8fed1d5c398d5
https://git.kernel.org/stable/c/b5409311b606d536cc485f3706c242c2afa93edb
https://git.kernel.org/stable/c/ec15f6a50183fc01f470af74ad49900fb3731fca
https://nvd.nist.gov/vuln/detail/CVE-2026-98477
https://www.cve.org/CVERecord?id=CVE-2026-98477

History

Wed, 21 Oct 2026 13:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/98181f9721f75f1a544dc563b0d8fed1d5c398d5

Tue, 20 Oct 2026 12:45:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98477.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98477 https://www.cve.org/CVERecord?id=CVE-2026-98477
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sun, 18 Oct 2026 17:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Sun, 18 Oct 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix NULL pmu_ctx passed to pmu->sched_task() perf_pmu_sched_task() returns early when cpuctx->task_ctx is set, and cpc->task_epc is only non-NULL while a task context is scheduled in on this CPU. __perf_pmu_sched_task() therefore always passes NULL: Unable to handle kernel NULL pointer dereference at virtual address 00 pc : armv8pmu_sched_task+0x14/0x50 Call trace: armv8pmu_sched_task+0x14/0x50 (P) perf_pmu_sched_task+0xac/0x108 __perf_event_task_sched_out+0x6c/0xe0 Pass &cpc->epc instead, the CPU-wide context for this PMU, which the function already dereferences a few lines up to find pmu. armv8pmu_sched_task() is the only in-tree implementation that dereferences the argument, and it only reads ->pmu, so the oops needs BRBE, added in v6.17.
Title		perf/core: Fix NULL pmu_ctx passed to pmu->sched_task()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/249a2bd87a0e57dc28f36e992807edc9cae309b5 https://git.kernel.org/stable/c/36bb85cf36cab15fb611cb44b78a5df06e4e69a2 https://git.kernel.org/stable/c/b5409311b606d536cc485f3706c242c2afa93edb https://git.kernel.org/stable/c/ec15f6a50183fc01f470af74ad49900fb3731fca

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-18T15:15:51.475Z

Updated: 2026-10-21T12:55:10.170Z

Reserved: 2026-09-25T10:25:14.351Z

Link: CVE-2026-98477

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-18T16:16:58.243

Modified: 2026-10-21T13:21:31.320

Link: CVE-2026-98477

Redhat

Severity : Moderate

Publid Date: 2026-10-18T00:00:00Z

Links: CVE-2026-98477 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-22T23:15:13Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object