CVE-2026-98477 perf/core: Fix NULL pmu_ctx passed to pmu->sched_task()
A local attacker can trigger a kernel crash via NULL pointer dereference in perf subsystem when BRBE is enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98477?
CVE-2026-98477 is a vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
perf/core: Fix NULL pmu_ctx passed to pmu->sched_task()
perf_pmu_sched_task() returns early when cpuctx->task_ctx is set, and cpc->task_epc is only non-NULL while a task context is scheduled in on this CPU. __perf_pmu_sched_task() therefore always passes NULL:
Unable to handle kernel NULL pointer dereference at virtual address 00 pc : armv8pmu_sched_task+0x14/0x50 Call trace: armv8pmu_sched_task+0x14/0x50 (P) perf_pmu_sched_task+0xac/0x108 __perf_event_task_sched_out+0x6c/0xe0
Pass &cpc->epc instead, the CPU-wide context for this PMU, which the function already dereferences a few lines up to find pmu.
armv8pmu_sched_task() is the only in-tree implementation that dereferences the argument, and it only reads ->pmu, so the oops needs BRBE, added in v6.17.
Which versions are affected by CVE-2026-98477?
How do I fix CVE-2026-98477?
Apply the vendor's patch.
Is CVE-2026-98477 being exploited?
There is no known exploitation of CVE-2026-98477 in the wild and no public exploit code.
Sources
Also known as AZL-108794, BELL-CVE-2026-98477, DEBIAN-CVE-2026-98477, GHSA-23r4-4gr3-gjfw, UBUNTU-CVE-2026-98477.