CVE-2026-98268

A flaw was found in the Linux kernel's performance monitoring (perf) subsystem. This vulnerability allows a local user to cause a Denial of Service (DoS) by crashing the operating system. When a kernel module is unloaded while a performance event remains active, the kernel clears the associated monitoring pointer. Subsequently closing the event causes the kernel to access this null pointer, resulting in a kernel crash.

A flaw of low impact was found in the Linux kernel's performance monitoring (perf) subsystem, affecting Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 2. A local user with an active perf event open can trigger a NULL pointer dereference when the kernel module backing the associated PMU is unloaded: the PMU unregister path clears event->pmu, and later closing the perf connection reaches is_include_guest_event() via mediated_pmu_unaccount_event() in _free_event(), which dereferences the NULL pointer. The result is a kernel oops/panic, i.e. a local denial of service limited to system availability, with no confidentiality or integrity impact supported by the evidence.

The vulnerable mediated guest vPMU code is present only in newer kernels, so this flaw affects Red Hat Enterprise Linux 10.3 and 10.4 and the Red Hat In-Vehicle OS 2 streams (kernel and kernel-ivos-qualcomm). Earlier Red Hat Enterprise Linux versions (including 6, 7, 8, 9, and the 10.0/10.2 streams), the kernel-rt variants, and the OpenShift Container Platform RHEL CoreOS images are marked not affected because the vulnerable code is not present in those kernels. Fixes for the affected streams are currently deferred to a future update because of the low severity and the specific conditions required to trigger the crash; the residual risk is that a local user could crash an affected system under those conditions.

Red Hat rates the impact of this flaw as Low, lower than the Moderate severity implied by the CVSS:3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), because exploitation requires a specific sequence of an active perf connection combined with a PMU module unload, and the consequence is limited to denial of service on the local system.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.