CVE-2026-98477: Linux Kernel Use-After-Free Vulnerability

CVE-2026-98477 Overview

CVE-2026-98477 is a NULL pointer dereference vulnerability in the Linux kernel's perf/core subsystem. The flaw occurs in __perf_pmu_sched_task(), which passes a NULL pmu_ctx argument to the PMU's sched_task() callback. On arm64 systems, armv8pmu_sched_task() dereferences this pointer to access the ->pmu field, triggering a kernel oops. The condition requires the Branch Record Buffer Extension (BRBE) feature, introduced in Linux kernel v6.17. The fix passes &cpc->epc, the CPU-wide context for the PMU, which the function already dereferences to locate the PMU.

Critical Impact
Local users on affected arm64 systems with BRBE enabled can trigger a kernel NULL pointer dereference, resulting in a denial of service through kernel crash.

Affected Products

Linux kernel versions incorporating the BRBE support introduced in v6.17
arm64 systems with Branch Record Buffer Extension (BRBE) hardware support
Builds using the perf subsystem with armv8pmu_sched_task() enabled

Discovery Timeline

2026-10-18 - CVE-2026-98477 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-98477

Vulnerability Analysis

The vulnerability resides in the kernel's performance monitoring unit (PMU) scheduling path. The function perf_pmu_sched_task() returns early when cpuctx->task_ctx is set, and cpc->task_epc is only non-NULL while a task context is scheduled in on the current CPU. As a consequence, __perf_pmu_sched_task() always passes NULL as the pmu_ctx argument to the PMU-specific sched_task() callback.

On arm64 platforms, armv8pmu_sched_task() is the only in-tree implementation that dereferences this argument. The function reads the ->pmu field from the passed context, which triggers a kernel NULL pointer dereference at a low virtual address. The resulting call trace shows armv8pmu_sched_task+0x14/0x50 called from perf_pmu_sched_task+0xac/0x108 and __perf_event_task_sched_out+0x6c/0xe0.

Root Cause

The root cause is an API contract mismatch between the generic perf core scheduling path and the PMU callback implementations. The caller passed NULL under the assumption that the callee could handle it, while armv8pmu_sched_task() unconditionally dereferences the pointer to retrieve the associated PMU. This represents a classic NULL pointer dereference in kernel code [CWE-476].

Attack Vector

Triggering the crash requires BRBE support, which was added in Linux kernel v6.17. A local user with the ability to create perf events on an affected arm64 system can cause the kernel to invoke the vulnerable scheduling path during task context switches. The dereference occurs in kernel mode, producing an oops and a denial of service. The vulnerability does not require elevated privileges beyond those needed to use the perf subsystem.

No verified exploitation code is published. For technical specifics, review the upstream fixes referenced in the Kernel Git Commit 249a2bd and Kernel Git Commit b540931.

Detection Methods for CVE-2026-98477

Indicators of Compromise

Kernel oops messages referencing armv8pmu_sched_task+0x14/0x50 in dmesg or system logs
Call traces including perf_pmu_sched_task and __perf_event_task_sched_out
Unexpected kernel panics on arm64 hosts shortly after perf event creation by unprivileged users

Detection Strategies

Inventory arm64 Linux systems running kernel v6.17 or later with BRBE-capable hardware
Monitor /var/log/kern.log and journald for NULL pointer dereference traces originating in the perf subsystem
Correlate perf_event_open syscall activity from non-root users with subsequent kernel crash events

Monitoring Recommendations

Centralize kernel log collection to detect oops signatures across the fleet
Alert on repeated kernel crashes on the same host, which may indicate automated or repeated triggering
Audit perf_event_paranoid sysctl settings to understand which users can create perf events

How to Mitigate CVE-2026-98477

Immediate Actions Required

Apply the upstream stable kernel updates containing the fix to all affected arm64 systems
If patching is not immediately feasible, restrict perf subsystem access by raising kernel.perf_event_paranoid to 3
Review and limit local user access on arm64 hosts running kernel v6.17 or later with BRBE enabled

Patch Information

Upstream fixes are available in the following stable kernel commits: Kernel Git Commit 249a2bd, Kernel Git Commit 36bb85c, Kernel Git Commit 98181f9, Kernel Git Commit b540931, and Kernel Git Commit ec15f6a. The fix changes __perf_pmu_sched_task() to pass &cpc->epc instead of NULL to the PMU callback.

Workarounds

Disable BRBE support in the kernel configuration or at boot if the feature is not required
Set kernel.perf_event_paranoid=3 via sysctl to prevent unprivileged users from creating perf events
Restrict shell access on affected arm64 systems to trusted users only until the patch is applied

bash

# Configuration example
# Restrict perf_event access to root only
sudo sysctl -w kernel.perf_event_paranoid=3
echo 'kernel.perf_event_paranoid=3' | sudo tee /etc/sysctl.d/99-perf-hardening.conf

# Verify kernel version on arm64 systems
uname -rm