All vulnerabilities
CVE-2026-98477

Linux: perf/core: Fix NULL pmu_ctx passed to pmu->sched_task()

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in98181f9721f75f1a544dc563b0d8fed1d5c398d5Also 249a2bd87a0e57dc28f36e992807edc9cae309b5, 36bb85cf36cab15fb611cb44b78a5df06e4e69a2CVE List
Published18 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

  • 98181f9721f75f1a544dc563b0d8fed1d5c398d5LinuxCVE List
  • 249a2bd87a0e57dc28f36e992807edc9cae309b5LinuxCVE List
  • 36bb85cf36cab15fb611cb44b78a5df06e4e69a2LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

perf/core: Fix NULL pmu_ctx passed to pmu->sched_task()

perf_pmu_sched_task() returns early when cpuctx->task_ctx is set, and cpc->task_epc is only non-NULL while a task context is scheduled in on this CPU. __perf_pmu_sched_task() therefore always passes NULL:

Unable to handle kernel NULL pointer dereference at virtual address 00 pc : armv8pmu_sched_task+0x14/0x50 Call trace: armv8pmu_sched_task+0x14/0x50 (P) perf_pmu_sched_task+0xac/0x108 __perf_event_task_sched_out+0x6c/0xe0

Pass &cpc->epc instead, the CPU-wide context for this PMU, which the function already dereferences a few lines up to find pmu.

armv8pmu_sched_task() is the only in-tree implementation that dereferences the argument, and it only reads ->pmu, so the oops needs BRBE, added in v6.17.

Text from CVE List

Affected versions 12

  • Linuxaffected: bd27568117664b8b3e259721393df420ed51f57b before 98181f9721f75f1a544dc563b0d8fed1d5c398d5CVE List
  • Linuxaffected: bd27568117664b8b3e259721393df420ed51f57b before b5409311b606d536cc485f3706c242c2afa93edbCVE List
  • Linuxaffected: bd27568117664b8b3e259721393df420ed51f57b before 249a2bd87a0e57dc28f36e992807edc9cae309b5CVE List
  • Linuxaffected: bd27568117664b8b3e259721393df420ed51f57b before ec15f6a50183fc01f470af74ad49900fb3731fcaCVE List
  • Linuxaffected: bd27568117664b8b3e259721393df420ed51f57b before 36bb85cf36cab15fb611cb44b78a5df06e4e69a2CVE List
  • Linuxaffected: 6.2CVE List
  • Linuxunaffected: all versions before 6.2CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.55 through 6.18.*CVE List
  • Linuxunaffected: 7.2.9 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5