Cloudanix VulnDB

CVE-2026-98546

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A setup error in the Linux kernel on certain processors can make the whole system crash when performance monitoring tools are used by regular programs.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Misconfiguration
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Incorrect initialization of HDFGWTR2_EL2 in arm64 EL2 fine-grained trap setup leaves the nPMZR_EL0 trap bit unset, so writes to the write-only PMZR_EL0 register from EL0 trap into the nVHE hypervisor which has no handler and calls BUG().

Why it matters to the business

Systems running the affected kernel with perf_user_access enabled can experience sudden, unrecoverable crashes that interrupt workloads and require manual intervention to restore service.

How an attack unfolds

An attacker with the ability to create a user-readable perf event on a system where kernel.perf_user_access=1 triggers a write to PMZR_EL0 from userspace; the missing trap bit causes an immediate unhandled exception at EL2 and host crash.

How to fix it

Update to a kernel containing the corrected __init_el2_fgt2() logic that accumulates HDFGWTR2_EL2 bits separately and explicitly sets nPMZR_EL0 along with the other FEAT_PMUv3p9 bits.

How to confirm the fix worked

Boot the patched kernel, confirm the updated __init_el2_fgt2() source or binary, and verify that HDFGWTR2_EL2 now contains the nPMZR_EL0 bit when FEAT_PMUv3p9 is present.

Typical attack path

  1. Enable kernel.perf_user_access=1 on the target host
  2. Create a perf event configured for user read access
  3. Perform an operation that causes a write to PMZR_EL0 from EL0
  4. Trigger the unhandled trap at EL2 resulting in BUG()

How to detect it

Search kernel logs for BUG() entries originating from the nVHE hypervisor shortly after perf event creation or when kernel.perf_user_access is active; examine dmesg and journalctl for arm64 EL2 trap handling failures.

What your security team should do

  • Prioritize kernel updates on arm64 systems that expose perf events to user space
  • Temporarily disable kernel.perf_user_access where the feature is not required
  • Monitor for unexplained arm64 BUG() crashes in nVHE context after perf event creation

The record

In the Linux kernel, the following vulnerability has been resolved: arm64/boot: Disable trapping of PMZR_EL0 writes to EL2 __init_el2_fgt2() writes one mask to both HDFGRTR2_EL2 and HDFGWTR2_EL2. PMZR_EL0 is write-only, so its trap bit, nPMZR_EL0, exists only in HDFGWTR2_EL2 and is therefore never set: a PMZR_EL0 write from the host traps to EL2, where the nVHE hypervisor has no handler and BUG()s. The kernel never writes PMZR_EL0, but kernel.perf_user_access=1 has the PMU driver set PMUSERENR_EL0.UEN for a task with a user-read event, so a write from EL0 reaches the trap and takes the host down without a panic message. Accumulate the HDFGWTR2_EL2 bits separately, as __init_el2_fgt() already does for HDFGWTR_EL2, and set nPMZR_EL0 with the other FEAT_PMUv3p9 bits.

Affected packages

Ecosystem Package Introduced Fixed