CVE-2026-98546arm64/boot: Disable trapping of PMZR_EL0 writes to EL2
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: arm64/boot: Disable trapping of PMZR_EL0 writes to EL2 __init_el2_fgt2() writes one mask to both HDFGRTR2_EL2 and HDFGWTR2_EL2. PMZR_EL0 is write-only, so its trap bit, nPMZR_EL0, exists only in HDFGWTR2_EL2 and is therefore never set: a PMZR_EL0 write from the host traps to EL2, where the nVHE hypervisor has no handler and BUG()s. The kernel never writes PMZR_EL0, but kernel.perf_user_access=1 has the PMU driver set PMUSERENR_EL0.UEN for a task with a user-read event, so a write from EL0 reaches the trap and takes the host down without a panic message. Accumulate the HDFGWTR2_EL2 bits separately, as __init_el2_fgt() already does for HDFGWTR_EL2, and set nPMZR_EL0 with the other FEAT_PMUv3p9 bits.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 18, 2026
- First seen by InfoSec Signals
- Oct 18, 2026
Affected products
Linux Linux linux:linux (from the name) | from 686d8f7b592f3466f44aea653c8147611b351c83 before bb8c90c86441c090e9036f019cf1b4d7894a2c40; 858c7bfcb35e1100b58bb63c9f562d86e09418d9 builds before 071f51188a5d8ec10535541255587976d12fc7d8; from 858c7bfcb35e1100b58bb63c9f562d86e09418d9 before ce71865bf43f88bed9d9218e9218e537150be506; 858c7bfcb35e1100b58bb63c9f562d86e09418d9 builds before 2bc6b218717b9d08f466f88209251d54bc09b207; 882f78400322c0aec4b641a7168adad9a66bc0c2; from 6.12.25 before 6.12.112; from 6.14.4 before 6.15 | CNA record |
References
- https://git.kernel.org/stable/c/bb8c90c86441c090e9036f019cf1b4d7894a2c40
- https://git.kernel.org/stable/c/071f51188a5d8ec10535541255587976d12fc7d8
- https://git.kernel.org/stable/c/ce71865bf43f88bed9d9218e9218e537150be506
- https://git.kernel.org/stable/c/2bc6b218717b9d08f466f88209251d54bc09b207
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.