CVE-2026-98546
In the Linux kernel, the following vulnerability has been resolved: arm64/boot: Disable trapping of PMZR_EL0 writes to EL2 __init_el2_fgt2() writes one mask to both HDFGRTR2_EL2 and HDFGWTR2_EL2. PMZR_EL0 is write-only, so its trap bit, nPMZR_EL0, exists only in HDFGWTR2_EL2 and is therefore never set: a PMZR_EL0 write from the host traps to EL2, where the nVHE hypervisor has no handler and BUG()s. The kernel never writes PMZR_EL0, but kernel.perf_user_access=1 has the PMU driver set PMUSERENR_EL0.UEN for a task with a user-read event, so a write from EL0 reaches the trap and takes the host down without a panic message. Accumulate the HDFGWTR2_EL2 bits separately, as __init_el2_fgt() already does for HDFGWTR_EL2, and set nPMZR_EL0 with the other FEAT_PMUv3p9 bits.
Affected versions
Linux kernel versions
6.12.25,
6.14.4,
6.15
and later are affected. Fixed in
6.12.112,
6.18.55,
7.2.9,
7.3
and their respective stable series.
References
4 totalFrequently asked questions
-
What is CVE-2026-98546?
CVE-2026-98546 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 6.12.25 onward and has been patched in 6.12.112, 6.18.55, 7.2.9 and others. CVE-2026-98546 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-98546?
Yes. CVE-2026-98546 has been patched. Fixed versions include 6.12.112, 6.18.55, 7.2.9 and others. If you are running Linux kernel 6.12.25 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-98546 actively exploited?
No. CVE-2026-98546 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.