UBUNTU-CVE-2026-98268: Null Pointer Dereference
In the Linux kernel, the following vulnerability has been resolved: perf: Fix null pointer access in isincludeguestevent() A typical module unload occurring event when there is an active perf connection leads to freeing of the pmu pointer. The call log is something like: .. pmudetachevent pmudetachevent pmudetachevents perfpmuunregister .. pmudetachevent() sets event->pmu to null. When the perf connection finally is closed, the following stack trace is observed: Oops: general protection fault, kernel NULL pointer dereference ... RIP: 0010:freeevent+0x3e/0x370 ... Call Trace: ... perfeventreleasekernel+0x260/0x2d0 perfrelease+0x12/0x20 A call to mediatedpmuunaccountevent() inside freeevent() is the root cause of this crash. Adding a check inside isincludeguestevent() ensures we don't accidentally access a null pmu ptr. In addition to this, we will now call mediatedpmuunaccountevent() before clearing the pmu ptr so that nrincludeguestevents counts are maintained correctly.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which Ubuntu kernel packages are listed as affected?
The affected software list includes ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-hwe-edge, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, and ubuntu/linux-aws-5.0. The provided data does not identify specific affected or fixed package versions.
What conditions are needed to trigger the failure?
A perf connection must remain active while a module unload causes the relevant PMU to be unregistered and the event's PMU pointer to be cleared. Closing the perf connection afterward can invoke the affected event cleanup path.
What evidence would indicate that a system encountered this issue?
The documented symptom is a kernel Oops caused by a general protection fault or kernel NULL pointer dereference during perf event release. The call trace can include _free_event, perf_event_release_kernel, and perf_release.