CVE-2026-98477

perf/core: Fix NULL pmu_ctx passed to pmu->sched_task()

State: Published
Severity: Not scored
Published: Oct 18, 2026
Updated: Oct 21, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

perf/core: Fix NULL pmu_ctx passed to pmu->sched_task()

perf_pmu_sched_task() returns early when cpuctx->task_ctx is set, and cpc->task_epc is only non-NULL while a task context is scheduled in on this CPU. __perf_pmu_sched_task() therefore always passes NULL:

Unable to handle kernel NULL pointer dereference at virtual address 00 pc : armv8pmu_sched_task+0x14/0x50 Call trace: armv8pmu_sched_task+0x14/0x50 (P) perf_pmu_sched_task+0xac/0x108 __perf_event_task_sched_out+0x6c/0xe0

Pass &cpc->epc instead, the CPU-wide context for this PMU, which the function already dereferences a few lines up to find pmu.

armv8pmu_sched_task() is the only in-tree implementation that dereferences the argument, and it only reads ->pmu, so the oops needs BRBE, added in v6.17.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	bd27568117664b8b3e259721393df420ed51f57b to before 98181f9721f75f1a544dc563b0d8fed1d5c398d5Affected bd27568117664b8b3e259721393df420ed51f57b to before b5409311b606d536cc485f3706c242c2afa93edbAffected bd27568117664b8b3e259721393df420ed51f57b to before 249a2bd87a0e57dc28f36e992807edc9cae309b5Affected bd27568117664b8b3e259721393df420ed51f57b to before ec15f6a50183fc01f470af74ad49900fb3731fcaAffected bd27568117664b8b3e259721393df420ed51f57b to before 36bb85cf36cab15fb611cb44b78a5df06e4e69a2Affected
LinuxLinux	6.2Affected before 6.2Not affected 6.6.160 through 6.6.Not affected 6.12.112 through 6.12.Not affected 6.18.55 through 6.18.Not affected 7.2.9 through 7.2.Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

bd27568117664b8b3e259721393df420ed51f57b to before 98181f9721f75f1a544dc563b0d8fed1d5c398d5Affected
bd27568117664b8b3e259721393df420ed51f57b to before b5409311b606d536cc485f3706c242c2afa93edbAffected
bd27568117664b8b3e259721393df420ed51f57b to before 249a2bd87a0e57dc28f36e992807edc9cae309b5Affected
bd27568117664b8b3e259721393df420ed51f57b to before ec15f6a50183fc01f470af74ad49900fb3731fcaAffected
bd27568117664b8b3e259721393df420ed51f57b to before 36bb85cf36cab15fb611cb44b78a5df06e4e69a2Affected

LinuxLinux

6.2Affected
before 6.2Not affected
6.6.160 through 6.6.*Not affected
6.12.112 through 6.12.*Not affected
6.18.55 through 6.18.*Not affected
7.2.9 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.