CVE-2026-98268: perf: Fix null pointer access in is_include_guest_event()
In the Linux kernel, the following vulnerability has been resolved:
perf: Fix null pointer access in isincludeguestevent()
A typical module unload occurring event when there is an active perf connection leads to freeing of the pmu pointer. The call log is something like: .. pmudetachevent pmudetachevent pmudetachevents perfpmuunregister ..
pmudetachevent() sets event->pmu to null. When the perf connection finally is closed, the following stack trace is observed:
Oops: general protection fault, kernel NULL pointer dereference ... RIP: 0010:freeevent+0x3e/0x370 ... Call Trace: ... perfeventreleasekernel+0x260/0x2d0 perfrelease+0x12/0x20
A call to mediatedpmuunaccountevent() inside freeevent() is the root cause of this crash. Adding a check inside isincludeguestevent() ensures we don't accidentally access a null pmu ptr. In addition to this, we will now call mediatedpmuunaccountevent() before clearing the pmu ptr so that nrincludeguestevents counts are maintained correctly.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
What conditions are required to trigger the crash?
A PMU module must be unloaded while there is an active perf connection using an event associated with that PMU. When that perf connection is later closed, cleanup can dereference the event's cleared PMU pointer.
What is the practical impact?
The described outcome is a kernel NULL pointer dereference and general protection fault during perf event cleanup. This can crash the affected Linux kernel.
How does the fix preserve guest-event accounting?
The fix adds a NULL check in is_include_guest_event() to avoid accessing a cleared PMU pointer. It also performs mediated_pmu_unaccount_event() before the PMU pointer is cleared, preserving nr_include_guest_events accounting.