CVE-2026-98477 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
perf/core: Fix NULL pmu_ctx passed to pmu->sched_task()
perf_pmu_sched_task() returns early when cpuctx->task_ctx is set, and cpc->task_epc is only non-NULL while a task context is scheduled in on this CPU. __perf_pmu_sched_task() therefore always passes NULL:
Unable to handle kernel NULL pointer dereference at virtual address 00 pc : armv8pmu_sched_task+0x14/0x50 Call trace: armv8pmu_sched_task+0x14/0x50 (P) perf_pmu_sched_task+0xac/0x108 __perf_event_task_sched_out+0x6c/0xe0
Pass &cpc->epc instead, the CPU-wide context for this PMU, which the function already dereferences a few lines up to find pmu.
armv8pmu_sched_task() is the only in-tree implementation that dereferences the argument, and it only reads ->pmu, so the oops needs BRBE, added in v6.17.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/19/2026
The Linux kernel performance subsystem contains a critical logic flaw within the perf core code related to how CPU-wide context is handled during task scheduling transitions. Specifically, the function perf_pmu_sched_task exhibits an incorrect assumption regarding the availability of per-task hardware performance monitoring unit contexts. When this function executes, it checks if cpuctx->task_ctx is set and returns early in certain conditions. However, under these specific circumstances, the pointer cpc->task_epc remains NULL because a task context has not been scheduled on that particular CPU at that moment. Despite this null state, the subsequent call to __perf_event_task_sched_out proceeds without adequate validation of whether a valid per-task context exists before attempting to pass it into lower-level PMU scheduling routines.
This logical error manifests as a kernel NULL pointer dereference when the armv8pmu_sched_task function is invoked on ARM64 architectures equipped with Branch Record Buffer Extension hardware, known as BRBE. The vulnerability was introduced or became exploitable starting from Linux version 6.17 where support for this specific hardware feature was added. During task scheduling out operations, if the system attempts to access members of a NULL pmu_ctx structure within armv8pmu_sched_task, it triggers an immediate kernel panic due to invalid memory access at address zero. The call trace confirms that the fault occurs deep in the perf subsystem when trying to dereference fields associated with the performance monitoring unit context that was incorrectly passed as null instead of a valid CPU-wide alternative.
The operational impact of this vulnerability is severe, resulting in system instability and potential denial of service through kernel oops or panic events on affected ARM64 systems utilizing BRBE capabilities. While the immediate crash prevents further execution within the current task scheduling path, it can lead to unplanned reboots if not handled by a watchdog or similar recovery mechanism. This issue primarily affects environments running recent kernels with specific hardware configurations and does not necessarily imply remote code execution but rather local stability degradation under heavy performance monitoring workloads involving context switches on affected CPUs.
To mitigate this risk, system administrators should ensure that the Linux kernel is updated to include the patch that corrects the argument passed to pmu->sched_task(). The fix involves modifying __perf_pmu_sched_task to pass &cpc->epc, which represents the CPU-wide context for the performance monitoring unit, rather than relying on potentially null per-task pointers. This adjustment aligns with standard practices in kernel development where NULL checks are enforced before dereferencing pointer arguments that may not be initialized depending on scheduling state. Users should also monitor system logs for signs of perf-related crashes and consider disabling BRBE-specific profiling features if immediate patching is not feasible, although upgrading the kernel remains the primary remediation strategy recommended by vendor security advisories.
From a classification perspective, this vulnerability aligns with CWE-476 which denotes NULL Pointer Dereference, a common software defect where code attempts to use a pointer that references no valid memory location. In terms of attack vectors and detection methodologies referenced in MITRE ATT&CK frameworks, such kernel-level crashes are typically categorized under Defense Evasion or Impact categories depending on whether the crash is induced maliciously by an unprivileged user attempting to disrupt system availability via crafted performance events. The lack of proper input validation regarding pointer validity before dereference represents a fundamental flaw in defensive coding practices within the subsystem logic.