CVE-2026-98546 - Vulnerability Details

- arm64/boot: Disable trapping of PMZR_EL0 writes to EL2

Description

In the Linux kernel, the following vulnerability has been resolved:

arm64/boot: Disable trapping of PMZR_EL0 writes to EL2

__init_el2_fgt2() writes one mask to both HDFGRTR2_EL2 and HDFGWTR2_EL2.
PMZR_EL0 is write-only, so its trap bit, nPMZR_EL0, exists only in
HDFGWTR2_EL2 and is therefore never set: a PMZR_EL0 write from the host
traps to EL2, where the nVHE hypervisor has no handler and BUG()s. The
kernel never writes PMZR_EL0, but kernel.perf_user_access=1 has the PMU
driver set PMUSERENR_EL0.UEN for a task with a user-read event, so a
write from EL0 reaches the trap and takes the host down without a panic
message.

Accumulate the HDFGWTR2_EL2 bits separately, as __init_el2_fgt() already
does for HDFGWTR_EL2, and set nPMZR_EL0 with the other FEAT_PMUv3p9
bits.

Published: 2026-10-18

Score: 4.7 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The flaw lies in the ARM64 Linux kernel’s boot code where writes to the PMZr_EL0 register are not correctly trapped when the system is executing in EL2. Because the trap bit for PMZr_EL0 never gets set, a user‑space write can be delivered to the hypervisor domain and trigger a BUG() without producing a standard panic message, causing the host to crash. The vulnerability therefore allows a privileged user process to bring down the entire kernel, potentially interrupting services without obvious log entries.

Affected Systems

All ARM64 Linux kernel builds that contain the unpatched boot sequence are vulnerable. The advisory does not specify a version range, so any kernel prior to the patch that introduces proper trap handling for PMZr_EL0 is considered at risk.

Risk and Exploitability

The CVSS score of 4.7 indicates a low severity impact, and the EPSS score of less than 1% shows the likelihood of exploitation is very low. The vulnerability is not listed in CISA's KEV catalog. The attack vector is expected to be local: a privileged or compromised user‑space process that writes to PMZr_EL0 via the perf interface when kernel.perf_user_access=1 can trigger the kernel BUG() in EL2, causing a host crash without a standard panic message, which may make detection harder.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`686d8f7b592f3466f44aea653c8147611b351c83`	affected	< bb8c90c86441c090e9036f019cf1b4d7894a2c40
`858c7bfcb35e1100b58bb63c9f562d86e09418d9`	affected	< 071f51188a5d8ec10535541255587976d12fc7d8
`858c7bfcb35e1100b58bb63c9f562d86e09418d9`	affected	< ce71865bf43f88bed9d9218e9218e537150be506
`858c7bfcb35e1100b58bb63c9f562d86e09418d9`	affected	< 2bc6b218717b9d08f466f88209251d54bc09b207
`882f78400322c0aec4b641a7168adad9a66bc0c2`	affected	—
`6.12.25`	affected	< 6.12.112
`6.14.4`	affected	< 6.15

Linux

affected

Version	Status	Constraints
`6.15`	affected	—
`0`	unaffected	< 6.15
`6.12.112`	unaffected	≤ 6.12.*
`6.18.55`	unaffected	≤ 6.18.*
`7.2.9`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[686d8f7b592f3466f44aea653c8147611b351c83,bb8c90c86441c090e9036f019cf1b4d7894a2c40)`	affected	code_commit	—
`[858c7bfcb35e1100b58bb63c9f562d86e09418d9,071f51188a5d8ec10535541255587976d12fc7d8)`	affected	code_commit	—
`[858c7bfcb35e1100b58bb63c9f562d86e09418d9,ce71865bf43f88bed9d9218e9218e537150be506)`	affected	code_commit	—
`[858c7bfcb35e1100b58bb63c9f562d86e09418d9,2bc6b218717b9d08f466f88209251d54bc09b207)`	affected	code_commit	—
`882f78400322c0aec4b641a7168adad9a66bc0c2`	affected	code_commit	—
`[6.12.25,6.12.112)`	affected	semver	—
`[6.14.4,6.15)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.15`	affected	semver	—
`[0,6.15)`	unaffected	semver	—
`[6.12.112,6.13.0)`	unaffected	semver	—
`[6.18.55,6.19.0)`	unaffected	semver	—
`[7.2.9,7.3.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Linux kernel to a patched version that disables trapping of PMZr_EL0 writes in EL2
If an update is delayed, set kernel.perf_user_access=0 to prevent user‑space PMU write access
Apply any vendor‑supplied updates for the hypervisor or firmware that address ARM64 trap handling bugs

Generated by OpenCVE AI on October 22, 2026 at 22:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4850-1	linux-6.12 security update

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.002.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98546.mbox
https://git.kernel.org/stable/c/071f51188a5d8ec10535541255587976d12fc7d8
https://git.kernel.org/stable/c/2bc6b218717b9d08f466f88209251d54bc09b207
https://git.kernel.org/stable/c/bb8c90c86441c090e9036f019cf1b4d7894a2c40
https://git.kernel.org/stable/c/ce71865bf43f88bed9d9218e9218e537150be506
https://nvd.nist.gov/vuln/detail/CVE-2026-98546
https://www.cve.org/CVERecord?id=CVE-2026-98546

History

Tue, 20 Oct 2026 20:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-665

Tue, 20 Oct 2026 12:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-617
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98546.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98546 https://www.cve.org/CVERecord?id=CVE-2026-98546
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sun, 18 Oct 2026 18:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-665

Sun, 18 Oct 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: arm64/boot: Disable trapping of PMZR_EL0 writes to EL2 __init_el2_fgt2() writes one mask to both HDFGRTR2_EL2 and HDFGWTR2_EL2. PMZR_EL0 is write-only, so its trap bit, nPMZR_EL0, exists only in HDFGWTR2_EL2 and is therefore never set: a PMZR_EL0 write from the host traps to EL2, where the nVHE hypervisor has no handler and BUG()s. The kernel never writes PMZR_EL0, but kernel.perf_user_access=1 has the PMU driver set PMUSERENR_EL0.UEN for a task with a user-read event, so a write from EL0 reaches the trap and takes the host down without a panic message. Accumulate the HDFGWTR2_EL2 bits separately, as __init_el2_fgt() already does for HDFGWTR_EL2, and set nPMZR_EL0 with the other FEAT_PMUv3p9 bits.
Title		arm64/boot: Disable trapping of PMZR_EL0 writes to EL2
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/071f51188a5d8ec10535541255587976d12fc7d8 https://git.kernel.org/stable/c/2bc6b218717b9d08f466f88209251d54bc09b207 https://git.kernel.org/stable/c/bb8c90c86441c090e9036f019cf1b4d7894a2c40 https://git.kernel.org/stable/c/ce71865bf43f88bed9d9218e9218e537150be506

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-18T15:18:14.808Z

Updated: 2026-10-19T09:21:29.442Z

Reserved: 2026-09-25T10:25:14.356Z

Link: CVE-2026-98546

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-18T16:17:06.517

Modified: 2026-10-19T10:19:10.600

Link: CVE-2026-98546

Redhat

Severity : Moderate

Publid Date: 2026-10-18T00:00:00Z

Links: CVE-2026-98546 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-22T22:30:13Z

Weaknesses

CWE-617
Reachable Assertion

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object