CVE-2026-98268

Received Received - Intake

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: perf: Fix null pointer access in is_include_guest_event() A typical module unload occurring event when there is an active perf connection leads to freeing of the pmu pointer. The call log is something like: .. __pmu_detach_event pmu_detach_event pmu_detach_events perf_pmu_unregister .. __pmu_detach_event() sets event->pmu to null. When the perf connection finally is closed, the following stack trace is observed: Oops: general protection fault, kernel NULL pointer dereference ... RIP: 0010:_free_event+0x3e/0x370 ... Call Trace: ... perf_event_release_kernel+0x260/0x2d0 perf_release+0x12/0x20 A call to mediated_pmu_unaccount_event() inside _free_event() is the root cause of this crash. Adding a check inside is_include_guest_event() ensures we don't accidentally access a null pmu ptr. In addition to this, we will now call mediated_pmu_unaccount_event() before clearing the pmu ptr so that nr_include_guest_events counts are maintained correctly.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98268

EUVD

EUVD-2026-93196

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	eff95e170275d9e80b968f335cd03d0ac250d2d1
Linux	Linux	eff95e170275d9e80b968f335cd03d0ac250d2d1
Linux	Linux	7.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a null pointer access issue in the function is_include_guest_event(). When a perf module unloads during an active perf connection, the pmu pointer is freed, leading to a kernel crash due to a general protection fault. The fix adds a check to prevent accessing a null pmu pointer and ensures correct counting of guest events.

Detection Guidance

This vulnerability is specific to the Linux kernel and relates to a null pointer dereference in the perf subsystem. Detection requires checking kernel logs for a general protection fault or kernel NULL pointer dereference related to perf_event_release_kernel or _free_event. Use commands like 'dmesg | grep -i "general protection fault"' or 'journalctl -k | grep -i "null pointer"' to identify crashes.

Impact Analysis

This vulnerability can cause system crashes (kernel oops) when a perf module unloads during an active connection. This may lead to denial of service, data loss, or system instability for users relying on perf tools for performance monitoring.

Compliance Impact

This vulnerability is a kernel-level issue in the Linux operating system that could lead to a system crash due to a null pointer dereference. It does not directly affect compliance with standards like GDPR or HIPAA, as those focus on data protection and privacy rather than system stability or kernel integrity.

Mitigation Strategies

Apply the latest Linux kernel patches that include the fix for this issue. Monitor kernel logs for signs of exploitation or crashes. If affected, reboot the system after patching to ensure the updated kernel is active.

Hi! I’m here to help you understand CVE-2026-98268. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70