CVE-2026-98546 Linux CVE debrief

Who should care

Linux kernel users with PMU driver and user-read events enabled; assess exposure and verify kernel version and configuration to ensure system security and prevent potential crashes. Operators, platform administrators, and security teams should review their systems for exposure and apply necessary mitigations to prevent exploitation.

Why it matters

Linux kernel vulnerability allows PMZR_EL0 writes to trap to EL2, potentially taking the host down. Assess exposure if Linux kernel is used with PMU driver and user-read events.

• Potential host crashes without panic messages
• Verification of Linux kernel version and configuration required
• Restrict PMU driver access to prevent exploitation

Technical summary

The Linux kernel vulnerability allows PMZR_EL0 writes from the host to trap to EL2, where the nVHE hypervisor has no handler and BUG()s. This occurs when kernel.perf_user_access=1 and the PMU driver sets PMUSERENR_EL0.UEN for a task with a user-read event. The issue arises from the kernel's handling of PMZR_EL0 writes, which can lead to unexpected behavior and potential system crashes. Linux kernel users should verify their kernel version and configuration to determine exposure and apply necessary mitigations to prevent exploitation.

Defensive priority

Verify Linux kernel version and configuration; restrict PMU driver access

Recommended defensive actions

• Verify Linux kernel version and configuration
• Restrict PMU driver access
• Monitor system for potential crashes
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The Linux kernel vulnerability was resolved by accumulating HDFGWTR2_EL2 bits separately and setting nPMZR_EL0 with FEAT_PMUv3p9 bits. Official CVE Program record and NVD vulnerability detail provide additional information. The fix involves modifying the kernel's handling of PMZR_EL0 writes to prevent unexpected behavior. Defenders should verify kernel version and configuration to ensure exposure is mitigated.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.