Cloudanix VulnDB

CVE-2026-98268

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A Linux kernel bug can crash the whole machine when certain hardware-monitoring modules are removed while performance tracking is active.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Null pointer dereference in perf event teardown path when a PMU is unregistered while an active perf connection exists; _free_event calls mediated_pmu_unaccount_event after event->pmu has already been cleared by __pmu_detach_event.

Why it matters to the business

Kernel panic or system crash on perf connection close after certain module unloads, causing denial of service and potential loss of observability data.

How an attack unfolds

An attacker or automated process triggers a PMU module unload while a perf session is active; on subsequent perf event release the kernel follows the null pmu pointer inside is_include_guest_event and mediated_pmu_unaccount_event, resulting in an oops.

How to fix it

Apply the upstream fix that adds a NULL check inside is_include_guest_event and moves the mediated_pmu_unaccount_event call before the pmu pointer is cleared; update to a kernel containing the resolution of CVE-2026-98268.

How to confirm the fix worked

Confirm the patched is_include_guest_event contains a guard against a null pmu pointer and that mediated_pmu_unaccount_event is invoked prior to clearing the pointer; test by repeating the unload-plus-perf-close sequence and verifying no NULL dereference occurs.

Typical attack path

  1. Start a perf session that registers interest in a PMU
  2. Unload the corresponding kernel module (or trigger perf_pmu_unregister)
  3. Close the perf file descriptor or exit the monitoring process
  4. Kernel executes _free_event with a null event->pmu, dereferencing it

How to detect it

Search kernel logs and crash dumps for the oops string 'general protection fault, kernel NULL pointer dereference' together with the call trace containing _free_event, perf_event_release_kernel and perf_pmu_unregister; correlate with recent module unload events.

  • Oops: general protection fault, kernel NULL pointer dereference
  • _free_event+0x3e/0x370
  • perf_event_release_kernel+0x260/0x2d0
  • perf_pmu_unregister
  • __pmu_detach_event

What your security team should do

  • Prioritize kernel updates on systems that expose perf to untrusted workloads or run dynamic module unloading
  • Monitor for the described oops signature in kernel logs
  • Restrict perf access via sysctl or capabilities until patches are deployed

The record

In the Linux kernel, the following vulnerability has been resolved: perf: Fix null pointer access in is_include_guest_event() A typical module unload occurring event when there is an active perf connection leads to freeing of the pmu pointer. The call log is something like: .. __pmu_detach_event pmu_detach_event pmu_detach_events perf_pmu_unregister .. __pmu_detach_event() sets event->pmu to null. When the perf connection finally is closed, the following stack trace is observed: Oops: general protection fault, kernel NULL pointer dereference ... RIP: 0010:_free_event+0x3e/0x370 ... Call Trace: ... perf_event_release_kernel+0x260/0x2d0 perf_release+0x12/0x20 A call to mediated_pmu_unaccount_event() inside _free_event() is the root cause of this crash. Adding a check inside is_include_guest_event() ensures we don't accidentally access a null pmu ptr. In addition to this, we will now call mediated_pmu_unaccount_event() before clearing the pmu ptr so that nr_include_guest_events counts are maintained correctly.

Affected packages

Ecosystem Package Introduced Fixed