Cloudanix VulnDB

CVE-2026-98477

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in the Linux kernel can make certain computers using ARM processors crash when performance tracking tools are active.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

NULL pointer dereference in armv8pmu_sched_task when perf_pmu_sched_task passes NULL pmu_ctx to pmu->sched_task during task context scheduling on CPUs with BRBE support.

Why it matters to the business

Kernel panic on affected ARMv8 systems under perf monitoring workloads can cause denial of service and unplanned downtime; low exploitability and recent publication limit immediate widespread risk.

How an attack unfolds

An attacker with local access triggers repeated perf event task scheduling on an ARMv8 CPU with BRBE enabled, causing the NULL dereference during __perf_event_task_sched_out.

How to fix it

Upgrade to a Linux kernel containing the fix for perf/core NULL pmu_ctx handling; rebuild and reboot with the patched kernel; disable perf monitoring on vulnerable ARMv8 systems as a temporary mitigation if patching is delayed.

How to confirm the fix worked

Confirm kernel source contains the commit passing &cpc->epc instead of NULL to __perf_pmu_sched_task; run perf sched on BRBE-capable ARMv8 hardware and verify no NULL dereference oops occurs.

Typical attack path

  1. Obtain local code execution on target Linux system
  2. Enable or trigger perf events that schedule task contexts on ARMv8 CPU
  3. Force task context switch that reaches perf_pmu_sched_task with NULL task_ctx
  4. Trigger armv8pmu_sched_task dereference of NULL pmu_ctx
  5. Cause kernel oops and system crash

How to detect it

Search kernel logs for armv8pmu_sched_task NULL pointer dereference call traces involving perf_pmu_sched_task and __perf_event_task_sched_out; correlate with perf event activity on ARMv8 systems.

What your security team should do

  • Prioritize kernel updates on ARMv8 servers and devices within standard patch windows
  • Monitor upstream stable kernel releases for backported fix
  • Restrict unprivileged perf access via sysctl until patched
  • Test perf workloads in staging environments before production rollout

The record

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix NULL pmu_ctx passed to pmu->sched_task() perf_pmu_sched_task() returns early when cpuctx->task_ctx is set, and cpc->task_epc is only non-NULL while a task context is scheduled in on this CPU. __perf_pmu_sched_task() therefore always passes NULL: Unable to handle kernel NULL pointer dereference at virtual address 00 pc : armv8pmu_sched_task+0x14/0x50 Call trace: armv8pmu_sched_task+0x14/0x50 (P) perf_pmu_sched_task+0xac/0x108 __perf_event_task_sched_out+0x6c/0xe0 Pass &cpc->epc instead, the CPU-wide context for this PMU, which the function already dereferences a few lines up to find pmu. armv8pmu_sched_task() is the only in-tree implementation that dereferences the argument, and it only reads ->pmu, so the oops needs BRBE, added in v6.17.

Affected packages

Ecosystem Package Introduced Fixed