Riskcovery

CVE-2026-98546

arm64/boot: Disable trapping of PMZR_EL0 writes to EL2

State
Published
Severity
Not scored
Published
Oct 18, 2026
Updated
Oct 19, 2026
Reserved
Sep 25, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

arm64/boot: Disable trapping of PMZR_EL0 writes to EL2

__init_el2_fgt2() writes one mask to both HDFGRTR2_EL2 and HDFGWTR2_EL2. PMZR_EL0 is write-only, so its trap bit, nPMZR_EL0, exists only in HDFGWTR2_EL2 and is therefore never set: a PMZR_EL0 write from the host traps to EL2, where the nVHE hypervisor has no handler and BUG()s. The kernel never writes PMZR_EL0, but kernel.perf_user_access=1 has the PMU driver set PMUSERENR_EL0.UEN for a task with a user-read event, so a write from EL0 reaches the trap and takes the host down without a panic message.

Accumulate the HDFGWTR2_EL2 bits separately, as __init_el2_fgt() already does for HDFGWTR_EL2, and set nPMZR_EL0 with the other FEAT_PMUv3p9 bits.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 686d8f7b592f3466f44aea653c8147611b351c83 to before bb8c90c86441c090e9036f019cf1b4d7894a2c40Affected
  • 858c7bfcb35e1100b58bb63c9f562d86e09418d9 to before 071f51188a5d8ec10535541255587976d12fc7d8Affected
  • 858c7bfcb35e1100b58bb63c9f562d86e09418d9 to before ce71865bf43f88bed9d9218e9218e537150be506Affected
  • 858c7bfcb35e1100b58bb63c9f562d86e09418d9 to before 2bc6b218717b9d08f466f88209251d54bc09b207Affected
  • 882f78400322c0aec4b641a7168adad9a66bc0c2Affected
  • 6.12.25 to before 6.12.112Affected
  • 6.14.4 to before 6.15Affected
LinuxLinux
  • 6.15Affected
  • before 6.15Not affected
  • 6.12.112 through 6.12.*Not affected
  • 6.18.55 through 6.18.*Not affected
  • 7.2.9 through 7.2.*Not affected
  • 7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.