CVE-2026-98477

A flaw was found in the Linux kernel's performance monitoring subsystem (perf). When switching tasks during performance event handling, the kernel can pass an uninitialized NULL pointer to hardware performance monitoring drivers. A local user can exploit this issue during task execution to trigger a kernel crash, resulting in a Denial of Service (DoS).

This vulnerability is rated as Moderate severity because exploitation requires local system access and is restricted to causing a denial of service, without enabling arbitrary code execution or data leakage. The issue occurs during task context switching and primarily affects systems with ARMv8 performance monitoring units that support branch recording capabilities. Consequently, workloads running on different processor architectures or configurations that do not expose these specialized hardware counters are not impacted.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.