{"id":"CVE-2026-98546","kind":"vulnerability","aliases":["CVE-2026-98546"],"related":[],"title":"Linux kernel arm64: PMZR_EL0 write from user space crashes host","description":"In the Linux kernel, the following vulnerability has been resolved:\n\narm64/boot: Disable trapping of PMZR_EL0 writes to EL2\n\n__init_el2_fgt2() writes one mask to both HDFGRTR2_EL2 and HDFGWTR2_EL2.\nPMZR_EL0 is write-only, so its trap bit, nPMZR_EL0, exists only in\nHDFGWTR2_EL2 and is therefore never set: a PMZR_EL0 write from the host\ntraps to EL2, where the nVHE hypervisor has no handler and BUG()s. The\nkernel never writes PMZR_EL0, but kernel.perf_user_access=1 has the PMU\ndriver set PMUSERENR_EL0.UEN for a task with a user-read event, so a\nwrite from EL0 reaches the trap and takes the host down without a panic\nmessage.\n\nAccumulate the HDFGWTR2_EL2 bits separately, as __init_el2_fgt() already\ndoes for HDFGWTR_EL2, and set nPMZR_EL0 with the other FEAT_PMUv3p9\nbits.","summary":"On arm64 Linux, a write to the PMZR_EL0 register traps to the nVHE hypervisor, which has no handler for it and calls BUG(), taking the host down. A user-space process with perf user access enabled can trigger this write and crash the machine without a panic message.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["arm64","kernel","linux","runtime","self-hosted"],"not_affected_if":["kernel.perf_user_access-0","managed-hosting","x86-64"],"how_to_check":"- `uname -r` and compare against the fixed kernel releases in the upstream stable tree\n- `sysctl kernel.perf_user_access` (a value of `1` is the exposed setting)\n- Confirm the host is arm64 with `uname -m` (`aarch64`)","fix":"- Update the kernel to a release that includes the upstream commit 'arm64/boot: Disable trapping of PMZR_EL0 writes to EL2'; exact fixed versions unknown from the sources\n- Until patched, set `kernel.perf_user_access` to `0` (`sysctl -w kernel.perf_user_access=0`) if perf user-read access is not needed","status":"open","published_at":"2026-10-18T16:17:06+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:23:37+00:00","updated_at":"2026-10-25T05:23:37+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T05:23:37Z","model":"claude-haiku-5-5","output":{"fix":"- Update the kernel to a release that includes the upstream commit 'arm64/boot: Disable trapping of PMZR_EL0 writes to EL2'; exact fixed versions unknown from the sources\n- Until patched, set `kernel.perf_user_access` to `0` (`sysctl -w kernel.perf_user_access=0`) if perf user-read access is not needed","reach":"local","title":"Linux kernel arm64: PMZR_EL0 write from user space crashes host","impact":"medium","summary":"On arm64 Linux, a write to the PMZR_EL0 register traps to the nVHE hypervisor, which has no handler for it and calls BUG(), taking the host down. A user-space process with perf user access enabled can trigger this write and crash the machine without a panic message.","category":"runtime","nicknames":[],"who_cares":["linux","arm64","kernel","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Host kernel crashes via hypervisor BUG() from an unprivileged write","analyst_note":"Sources give no severity, fixed kernel versions or stable commit IDs; check the NVD entry and the kernel.org stable advisories for affected version ranges.","how_to_check":"- `uname -r` and compare against the fixed kernel releases in the upstream stable tree\n- `sysctl kernel.perf_user_access` (a value of `1` is the exposed setting)\n- Confirm the host is arm64 with `uname -m` (`aarch64`)","needs_analyst":true,"not_affected_if":["x86-64","kernel.perf_user_access-0","managed-hosting"],"who_is_affected":"Affects arm64 Linux hosts running nVHE hypervisor mode where the PMU driver grants user-space read access to perf counters, which requires kernel.perf_user_access=1. Hosts on x86 or 32-bit systems, or arm64 systems without that setting, are not described as exposed. Teams running arm64 Linux servers or VMs with perf user access enabled should check first.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000729,"input_tokens":3596,"output_tokens":738,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98546':14A,17A '1':159C 'access':61B,158C 'accumul':192C 'alreadi':202C 'arm64':3A,18B,26B 'arm64/boot':85C 'bit':116C,196C,216C 'bug':48B,147C 'call':47B 'crash':10A,68B 'cve':12A,15A 'disabl':86C 'driver':163C 'el0':5A,33B,90C,108C,118C,131C,154C,179C,210C 'el2':93C,95C,103C,106C,123C,138C,195C,200C,206C 'enabl':62B 'event':174C 'exist':119C 'feat':214C 'fgt':201C 'fgt2':96C 'follow':80C 'handler':43B,145C 'hdfgrtr2':102C 'hdfgwtr':205C 'hdfgwtr2':105C,122C,194C 'host':11A,24B,51B,135C,186C 'hypervisor':39B,142C 'init':94C,199C 'kernel':2A,19B,78C,150C 'kernel.perf':156C 'linux':1A,20B,27B,77C 'machin':70B 'mask':99C 'messag':74B,191C 'never':127C,151C 'npmzr':117C,209C 'nvhe':38B,141C 'one':98C 'panic':73B,190C 'perf':59B 'pmu':162C 'pmuserenr_el0.uen':165C 'pmuv3p9':215C 'pmzr':4A,32B,89C,107C,130C,153C 'process':57B 'reach':180C 'read':173C 'regist':34B 'resolv':84C 'runtim':21B 'self':23B 'self-host':22B 'separ':197C 'set':128C,164C,208C 'space':9A,56B 'take':49B,184C 'task':168C 'therefor':126C 'trap':35B,87C,115C,136C,182C 'trigger':64B 'user':8A,55B,60B,157C,172C 'user-read':171C 'user-spac':54B 'vulner':81C 'without':71B,188C 'write':6A,29B,66B,91C,97C,111C,132C,152C,177C 'write-on':110C","nicknames":[],"mitigations":[],"who_affected":"Affects arm64 Linux hosts running nVHE hypervisor mode where the PMU driver grants user-space read access to perf counters, which requires kernel.perf_user_access=1. Hosts on x86 or 32-bit systems, or arm64 systems without that setting, are not described as exposed. Teams running arm64 Linux servers or VMs with perf user access enabled should check first.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:06+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98546","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98546","severity":null,"published_at":"2026-10-18T16:17:06+00:00","modified_at":"2026-10-19T10:19:10+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}