CVE-2026-98477

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98477", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.351Z", "datePublished": "2026-10-18T15:15:51.475Z", "dateUpdated": "2026-10-21T12:55:10.170Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:55:10.170Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/core: Fix NULL pmu_ctx passed to pmu->sched_task()\n\nperf_pmu_sched_task() returns early when cpuctx->task_ctx is set, and\ncpc->task_epc is only non-NULL while a task context is scheduled in on\nthis CPU. __perf_pmu_sched_task() therefore always passes NULL:\n\n Unable to handle kernel NULL pointer dereference at virtual address 00\n pc : armv8pmu_sched_task+0x14/0x50\n Call trace:\n armv8pmu_sched_task+0x14/0x50 (P)\n perf_pmu_sched_task+0xac/0x108\n __perf_event_task_sched_out+0x6c/0xe0\n\nPass &cpc->epc instead, the CPU-wide context for this PMU, which the\nfunction already dereferences a few lines up to find pmu.\n\narmv8pmu_sched_task() is the only in-tree implementation that\ndereferences the argument, and it only reads ->pmu, so the oops needs\nBRBE, added in v6.17."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/events/core.c"], "versions": [{"version": "bd27568117664b8b3e259721393df420ed51f57b", "lessThan": "98181f9721f75f1a544dc563b0d8fed1d5c398d5", "status": "affected", "versionType": "git"}, {"version": "bd27568117664b8b3e259721393df420ed51f57b", "lessThan": "b5409311b606d536cc485f3706c242c2afa93edb", "status": "affected", "versionType": "git"}, {"version": "bd27568117664b8b3e259721393df420ed51f57b", "lessThan": "249a2bd87a0e57dc28f36e992807edc9cae309b5", "status": "affected", "versionType": "git"}, {"version": "bd27568117664b8b3e259721393df420ed51f57b", "lessThan": "ec15f6a50183fc01f470af74ad49900fb3731fca", "status": "affected", "versionType": "git"}, {"version": "bd27568117664b8b3e259721393df420ed51f57b", "lessThan": "36bb85cf36cab15fb611cb44b78a5df06e4e69a2", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/events/core.c"], "versions": [{"version": "6.2", "status": "affected"}, {"version": "0", "lessThan": "6.2", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.55", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.18.55"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/98181f9721f75f1a544dc563b0d8fed1d5c398d5"}, {"url": "https://git.kernel.org/stable/c/b5409311b606d536cc485f3706c242c2afa93edb"}, {"url": "https://git.kernel.org/stable/c/249a2bd87a0e57dc28f36e992807edc9cae309b5"}, {"url": "https://git.kernel.org/stable/c/ec15f6a50183fc01f470af74ad49900fb3731fca"}, {"url": "https://git.kernel.org/stable/c/36bb85cf36cab15fb611cb44b78a5df06e4e69a2"}], "title": "perf/core: Fix NULL pmu_ctx passed to pmu->sched_task()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/events/core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "98181f9721f75f1a544dc563b0d8fed1d5c398d5", "status": "affected", "version": "bd27568117664b8b3e259721393df420ed51f57b", "versionType": "git"}, {"lessThan": "b5409311b606d536cc485f3706c242c2afa93edb", "status": "affected", "version": "bd27568117664b8b3e259721393df420ed51f57b", "versionType": "git"}, {"lessThan": "249a2bd87a0e57dc28f36e992807edc9cae309b5", "status": "affected", "version": "bd27568117664b8b3e259721393df420ed51f57b", "versionType": "git"}, {"lessThan": "ec15f6a50183fc01f470af74ad49900fb3731fca", "status": "affected", "version": "bd27568117664b8b3e259721393df420ed51f57b", "versionType": "git"}, {"lessThan": "36bb85cf36cab15fb611cb44b78a5df06e4e69a2", "status": "affected", "version": "bd27568117664b8b3e259721393df420ed51f57b", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/events/core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.2"}, {"lessThan": "6.2", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.55", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf/core: Fix NULL pmu_ctx passed to pmu->sched_task()\n\nperf_pmu_sched_task() returns early when cpuctx->task_ctx is set, and\ncpc->task_epc is only non-NULL while a task context is scheduled in on\nthis CPU. __perf_pmu_sched_task() therefore always passes NULL:\n\n Unable to handle kernel NULL pointer dereference at virtual address 00\n pc : armv8pmu_sched_task+0x14/0x50\n Call trace:\n armv8pmu_sched_task+0x14/0x50 (P)\n perf_pmu_sched_task+0xac/0x108\n __perf_event_task_sched_out+0x6c/0xe0\n\nPass &cpc->epc instead, the CPU-wide context for this PMU, which the\nfunction already dereferences a few lines up to find pmu.\n\narmv8pmu_sched_task() is the only in-tree implementation that\ndereferences the argument, and it only reads ->pmu, so the oops needs\nBRBE, added in v6.17."}], "id": "CVE-2026-98477", "lastModified": "2026-10-21T13:21:31.320", "metrics": {}, "published": "2026-10-18T16:16:58.243", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/249a2bd87a0e57dc28f36e992807edc9cae309b5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/36bb85cf36cab15fb611cb44b78a5df06e4e69a2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/98181f9721f75f1a544dc563b0d8fed1d5c398d5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b5409311b606d536cc485f3706c242c2afa93edb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ec15f6a50183fc01f470af74ad49900fb3731fca"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: perf/core: Fix NULL pmu_ctx passed to pmu->sched_task()", "id": "2554884", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2554884"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["A flaw was found in the Linux kernel's performance monitoring subsystem (perf). When switching tasks during performance event handling, the kernel can pass an uninitialized NULL pointer to hardware performance monitoring drivers. A local user can exploit this issue during task execution to trigger a kernel crash, resulting in a Denial of Service (DoS)."], "name": "CVE-2026-98477", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98477\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98477\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98477.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bd27568117664b8b3e259721393df420ed51f57b,b5409311b606d536cc485f3706c242c2afa93edb)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bd27568117664b8b3e259721393df420ed51f57b,249a2bd87a0e57dc28f36e992807edc9cae309b5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bd27568117664b8b3e259721393df420ed51f57b,ec15f6a50183fc01f470af74ad49900fb3731fca)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bd27568117664b8b3e259721393df420ed51f57b,36bb85cf36cab15fb611cb44b78a5df06e4e69a2)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.2"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.2)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.112,6.12.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.55,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2.9,7.2.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T16:45:17.333960+00:00", "updated": "2026-10-22T23:15:13.545547+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}