Live › vulnerability › CVE-2026-98546
Go to dashboardOn arm64 Linux, a write to the PMZR_EL0 register traps to the nVHE hypervisor, which has no handler for it and calls BUG(), taking the host down. A user-space process with perf user access enabled can trigger this write and crash the machine without a panic message.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Affects arm64 Linux hosts running nVHE hypervisor mode where the PMU driver grants user-space read access to perf counters, which requires kernel.perf_user_access=1. Hosts on x86 or 32-bit systems, or arm64 systems without that setting, are not described as exposed. Teams running arm64 Linux servers or VMs with perf user access enabled should check first.
No product ranges from the sources yet.
uname -r and compare against the fixed kernel releases in the upstream stable treesysctl kernel.perf_user_access (a value of 1 is the exposed setting)uname -m (aarch64)kernel.perf_user_access to 0 (sysctl -w kernel.perf_user_access=0) if perf user-read access is not neededEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
arm64/boot: Disable trapping of PMZR_EL0 writes to EL2
__init_el2_fgt2() writes one mask to both HDFGRTR2_EL2 and HDFGWTR2_EL2. PMZR_EL0 is write-only, so its trap bit, nPMZR_EL0, exists only in HDFGWTR2_EL2 and is therefore never set: a PMZR_EL0 write from the host traps to EL2, where the nVHE hypervisor has no handler and BUG()s. The kernel never writes PMZR_EL0, but kernel.perf_user_access=1 has the PMU driver set PMUSERENR_EL0.UEN for a task with a user-read event, so a write from EL0 reaches the trap and takes the host down without a panic message.
Accumulate the HDFGWTR2_EL2 bits separately, as __init_el2_fgt() already does for HDFGWTR_EL2, and set nPMZR_EL0 with the other FEAT_PMUv3p9 bits.
This page as .md · .json · in your agent: get_signal("CVE-2026-98546")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.