Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-98477

perf/core: Fix NULL pmu_ctx passed to pmu->sched_task()

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix NULL pmu_ctx passed to pmu->sched_task() perf_pmu_sched_task() returns early when cpuctx->task_ctx is set, and cpc->task_epc is only non-NULL while a task context is scheduled in on this CPU. __perf_pmu_sched_task() therefore always passes NULL: Unable to handle kernel NULL pointer dereference at virtual address 00 pc : armv8pmu_sched_task+0x14/0x50 Call trace: armv8pmu_sched_task+0x14/0x50 (P) perf_pmu_sched_task+0xac/0x108 __perf_event_task_sched_out+0x6c/0xe0 Pass &cpc->epc instead, the CPU-wide context for this PMU, which the function already dereferences a few lines up to find pmu. armv8pmu_sched_task() is the only in-tree implementation that dereferences the argument, and it only reads ->pmu, so the oops needs BRBE, added in v6.17.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • bd27568117664b8b3e259721393df420ed51f57b to < 98181f9721f75f1a544dc563b0d8fed1d5c398d5affected
  • bd27568117664b8b3e259721393df420ed51f57b to < b5409311b606d536cc485f3706c242c2afa93edbaffected
  • bd27568117664b8b3e259721393df420ed51f57b to < 249a2bd87a0e57dc28f36e992807edc9cae309b5affected
  • bd27568117664b8b3e259721393df420ed51f57b to < ec15f6a50183fc01f470af74ad49900fb3731fcaaffected
  • bd27568117664b8b3e259721393df420ed51f57b to < 36bb85cf36cab15fb611cb44b78a5df06e4e69a2affected

Linux Linux

Default version status: affected

  • 6.2affected
  • 0 to < 6.2unaffected
  • 6.6.160 to ≤ 6.6.*unaffected
  • 6.12.112 to ≤ 6.12.*unaffected
  • 6.18.55 to ≤ 6.18.*unaffected
  • 7.2.9 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References