{"id":"CVE-2026-98477","kind":"vulnerability","aliases":["CVE-2026-98477"],"related":[],"title":"Linux kernel perf: NULL pointer dereference crashes ARM64 systems with BRBE","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nperf/core: Fix NULL pmu_ctx passed to pmu->sched_task()\n\nperf_pmu_sched_task() returns early when cpuctx->task_ctx is set, and\ncpc->task_epc is only non-NULL while a task context is scheduled in on\nthis CPU. __perf_pmu_sched_task() therefore always passes NULL:\n\n  Unable to handle kernel NULL pointer dereference at virtual address 00\n  pc : armv8pmu_sched_task+0x14/0x50\n  Call trace:\n   armv8pmu_sched_task+0x14/0x50 (P)\n   perf_pmu_sched_task+0xac/0x108\n   __perf_event_task_sched_out+0x6c/0xe0\n\nPass &cpc->epc instead, the CPU-wide context for this PMU, which the\nfunction already dereferences a few lines up to find pmu.\n\narmv8pmu_sched_task() is the only in-tree implementation that\ndereferences the argument, and it only reads ->pmu, so the oops needs\nBRBE, added in v6.17.","summary":"A bug in the Linux kernel's perf subsystem passes a NULL context pointer to the ARM PMU scheduling callback, causing a kernel oops. The sources describe a crash on systems using BRBE (ARM branch record buffer), and do not describe code execution.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["arm64","bare-metal","infrastructure","linux-kernel","perf"],"not_affected_if":["kernel-older-than-6.17","no-brbe-hardware","x86-64"],"how_to_check":"- Run `uname -r` and check whether the kernel is at or after v6.17 with the BRBE-enabled ARMv8 PMU driver present\n- unknown for a precise check of the fixed kernel version","fix":"- Update to a Linux kernel release that includes the upstream commit 'perf/core: Fix NULL pmu_ctx passed to pmu->sched_task()'\n- unknown for the exact patched version numbers","status":"open","published_at":"2026-10-18T16:16:58+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:25:56+00:00","updated_at":"2026-10-25T05:25:56+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T05:25:56Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel release that includes the upstream commit 'perf/core: Fix NULL pmu_ctx passed to pmu->sched_task()'\n- unknown for the exact patched version numbers","reach":"local","title":"Linux kernel perf: NULL pointer dereference crashes ARM64 systems with BRBE","impact":"low","summary":"A bug in the Linux kernel's perf subsystem passes a NULL context pointer to the ARM PMU scheduling callback, causing a kernel oops. The sources describe a crash on systems using BRBE (ARM branch record buffer), and do not describe code execution.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","arm64","perf","bare-metal"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Kernel NULL pointer dereference causes a crash on affected ARM64 systems","analyst_note":"Check the upstream kernel commit and NVD entry for the affected and fixed version ranges, and whether any exploitation beyond a denial-of-service crash is possible.","how_to_check":"- Run `uname -r` and check whether the kernel is at or after v6.17 with the BRBE-enabled ARMv8 PMU driver present\n- unknown for a precise check of the fixed kernel version","needs_analyst":true,"not_affected_if":["x86-64","no-brbe-hardware","kernel-older-than-6.17"],"who_is_affected":"Systems running Linux kernels from v6.17 onward on ARM64 hardware with BRBE support, where perf is used with the armv8 PMU driver. The sources describe a kernel crash rather than a remote compromise, so x86 systems and ARM systems without BRBE are not described as affected.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000684,"input_tokens":3596,"output_tokens":648,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':144C,151C,158C,165C '-2026':13A,16A '-98477':14A,17A '00':139C 'add':215C 'address':138C 'alreadi':182C 'alway':126C 'argument':204C 'arm':43B,60B 'arm64':8A,18B 'armv8pmu':141C,148C,191C 'bare':20B 'bare-met':19B 'branch':61B 'brbe':11A,59B,214C 'buffer':63B 'bug':28B 'call':146C 'callback':46B 'caus':47B 'code':68B 'context':39B,114C,175C 'cpc':103C,168C 'cpu':120C,173C 'cpu-wid':172C 'cpuctx':97C 'crash':7A,55B 'ctx':84C,99C 'cve':12A,15A 'derefer':6A,135C,183C,202C 'describ':53B,67B 'earli':95C 'epc':105C,169C 'event':161C 'execut':69B 'find':189C 'fix':81C 'follow':75C 'function':181C 'handl':131C 'implement':200C 'in-tre':197C 'infrastructur':22B 'instead':170C 'kernel':2A,25B,32B,49B,73C,132C 'line':186C 'linux':1A,24B,31B,72C 'linux-kernel':23B 'metal':21B 'need':213C 'non':109C 'non-nul':108C 'null':4A,38B,82C,110C,128C,133C 'oop':50B,212C 'p':153C 'pass':36B,85C,127C,167C 'pc':140C 'perf':3A,26B,34B,90C,121C,154C,160C 'perf/core':80C 'pmu':44B,83C,87C,91C,122C,155C,178C,190C,209C 'pointer':5A,40B,134C 'read':208C 'record':62B 'resolv':79C 'return':94C 'sched':88C,92C,123C,142C,149C,156C,163C,192C 'schedul':45B,116C 'set':101C 'sourc':52B 'subsystem':35B 'system':9A,57B 'task':89C,93C,98C,104C,113C,124C,143C,150C,157C,162C,193C 'therefor':125C 'trace':147C 'tree':199C 'unabl':129C 'use':58B 'v6.17':217C 'virtual':137C 'vulner':76C 'wide':174C 'x14/0x50':145C,152C 'x6c/0xe0':166C 'xac/0x108':159C","nicknames":[],"mitigations":[],"who_affected":"Systems running Linux kernels from v6.17 onward on ARM64 hardware with BRBE support, where perf is used with the armv8 PMU driver. The sources describe a kernel crash rather than a remote compromise, so x86 systems and ARM systems without BRBE are not described as affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:16:58+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98477","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98477","severity":null,"published_at":"2026-10-18T16:16:58+00:00","modified_at":"2026-10-21T13:21:31+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}