CVE-2026-98551

A flaw was found in the Linux kernel's Performance Events (perf) subsystem on ARM64 architectures. This flaw allows a local user to cause an information disclosure of sensitive kernel memory. The issue occurs because certain branch tracking data structures are not properly cleared, allowing an attacker reading branch records to access uninitialized kernel memory.

This vulnerability is classified as Low impact for Red Hat products because it requires local system access, cannot be exploited remotely, and only affects ARM64 hardware utilizing branch recording capabilities. While uninitialized heap memory can leak into user space through performance monitoring records, the exposure does not enable privilege escalation or permit tampering with kernel memory. Additionally, earlier enterprise releases such as Red Hat Enterprise Linux 7 and 8 do not contain the affected code and are not impacted.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.