---
id: "CVE-2026-98546"
kind: "vulnerability"
aliases: ["CVE-2026-98546"]
title: "Linux kernel arm64: PMZR_EL0 write from user space crashes host"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["arm64", "kernel", "linux", "runtime", "self-hosted"]
not_affected_if: ["kernel.perf_user_access-0", "managed-hosting", "x86-64"]
published_at: "2026-10-18T16:17:06+00:00"
first_seen_at: "2026-10-23T21:57:15+00:00"
updated_at: "2026-10-25T05:23:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98546", "first_seen_at": "2026-10-23T21:57:15+00:00"}]
---

# Linux kernel arm64: PMZR_EL0 write from user space crashes host

On arm64 Linux, a write to the PMZR_EL0 register traps to the nVHE hypervisor, which has no handler for it and calls BUG(), taking the host down. A user-space process with perf user access enabled can trigger this write and crash the machine without a panic message.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- `uname -r` and compare against the fixed kernel releases in the upstream stable tree
- `sysctl kernel.perf_user_access` (a value of `1` is the exposed setting)
- Confirm the host is arm64 with `uname -m` (`aarch64`)

## Fix

- Update the kernel to a release that includes the upstream commit 'arm64/boot: Disable trapping of PMZR_EL0 writes to EL2'; exact fixed versions unknown from the sources
- Until patched, set `kernel.perf_user_access` to `0` (`sysctl -w kernel.perf_user_access=0`) if perf user-read access is not needed

## Timeline

- 2026-10-23T21:57:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98546

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

arm64/boot: Disable trapping of PMZR_EL0 writes to EL2

__init_el2_fgt2() writes one mask to both HDFGRTR2_EL2 and HDFGWTR2_EL2.
PMZR_EL0 is write-only, so its trap bit, nPMZR_EL0, exists only in
HDFGWTR2_EL2 and is therefore never set: a PMZR_EL0 write from the host
traps to EL2, where the nVHE hypervisor has no handler and BUG()s. The
kernel never writes PMZR_EL0, but kernel.perf_user_access=1 has the PMU
driver set PMUSERENR_EL0.UEN for a task with a user-read event, so a
write from EL0 reaches the trap and takes the host down without a panic
message.

Accumulate the HDFGWTR2_EL2 bits separately, as __init_el2_fgt() already
does for HDFGWTR_EL2, and set nPMZR_EL0 with the other FEAT_PMUv3p9
bits.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_