{"id":"AZL-108794","summary":"CVE-2026-98477 affecting package kernel 6.6.157.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nperf/core: Fix NULL pmu_ctx passed to pmu-\u003esched_task()\n\nperf_pmu_sched_task() returns early when cpuctx-\u003etask_ctx is set, and\ncpc-\u003etask_epc is only non-NULL while a task context is scheduled in on\nthis CPU. __perf_pmu_sched_task() therefore always passes NULL:\n\n  Unable to handle kernel NULL pointer dereference at virtual address 00\n  pc : armv8pmu_sched_task+0x14/0x50\n  Call trace:\n   armv8pmu_sched_task+0x14/0x50 (P)\n   perf_pmu_sched_task+0xac/0x108\n   __perf_event_task_sched_out+0x6c/0xe0\n\nPass &cpc-\u003eepc instead, the CPU-wide context for this PMU, which the\nfunction already dereferences a few lines up to find pmu.\n\narmv8pmu_sched_task() is the only in-tree implementation that\ndereferences the argument, and it only reads -\u003epmu, so the oops needs\nBRBE, added in v6.17.","modified":"2026-10-19T14:16:49.623349183Z","published":"2026-10-18T16:16:58Z","upstream":["CVE-2026-98477"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98477"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.157.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-108794.json"}}],"schema_version":"1.9.0"}