CVE-2026-98477perf/core: Fix NULL pmu_ctx passed to pmu->sched_task()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix NULL pmu_ctx passed to pmu->sched_task() perf_pmu_sched_task() returns early when cpuctx->task_ctx is set, and cpc->task_epc is only non-NULL while a task context is scheduled in on this CPU. __perf_pmu_sched_task() therefore always passes NULL: Unable to handle kernel NULL pointer dereference at virtual address 00 pc : armv8pmu_sched_task+0x14/0x50 Call trace: armv8pmu_sched_task+0x14/0x50 (P) perf_pmu_sched_task+0xac/0x108 __perf_event_task_sched_out+0x6c/0xe0 Pass &cpc->epc instead, the CPU-wide context for this PMU, which the function already dereferences a few lines up to find pmu. armv8pmu_sched_task() is the only in-tree implementation that dereferences the argument, and it only reads ->pmu, so the oops needs BRBE, added in v6.17.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 18, 2026
- First seen by InfoSec Signals
- Oct 18, 2026
Affected products
Linux Linux linux:linux (from the name) | from bd27568117664b8b3e259721393df420ed51f57b before b5409311b606d536cc485f3706c242c2afa93edb; from bd27568117664b8b3e259721393df420ed51f57b before 249a2bd87a0e57dc28f36e992807edc9cae309b5; from bd27568117664b8b3e259721393df420ed51f57b before ec15f6a50183fc01f470af74ad49900fb3731fca; from bd27568117664b8b3e259721393df420ed51f57b before 36bb85cf36cab15fb611cb44b78a5df06e4e69a2 | CNA record |
References
- https://git.kernel.org/stable/c/b5409311b606d536cc485f3706c242c2afa93edb
- https://git.kernel.org/stable/c/249a2bd87a0e57dc28f36e992807edc9cae309b5
- https://git.kernel.org/stable/c/ec15f6a50183fc01f470af74ad49900fb3731fca
- https://git.kernel.org/stable/c/36bb85cf36cab15fb611cb44b78a5df06e4e69a2
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.