In the Linux kernel, the following vulnerability has been resolved: arm64/boot: Disable trapping of PMZR_EL0 writes to EL2 __init_el2_fgt2() writes… (CVE-2026-98546)

The vulnerability in the Linux kernel arm64 boot code involves improper handling of PMZR_EL0 writes to EL2. PMZR_EL0 is write-only, and its trap bit nPMZR_EL0 exists only in HDFGWTR2_EL2 but was never set, causing writes from EL0 to trap to EL2. Since the nVHE hypervisor has no handler for this trap, it triggers a BUG(), leading to a host crash without a panic message. This occurs when kernel.perf_user_access=1 enables the PMU driver to set PMUSERENR_EL0.UEN for tasks with user-read events, allowing a write from EL0 to cause the trap. The resolution involves accumulating the HDFGWTR2_EL2 bits separately and setting nPMZR_EL0 along with other FEAT_PMUv3p9 bits, preventing the trap and host crash.

The vulnerability can cause the host system to crash without a panic message when a write to PMZR_EL0 from EL0 traps to EL2 and the hypervisor lacks a handler. This can disrupt system stability and availability, particularly when kernel.perf_user_access=1 is enabled and user-read PMU events are active.

The vulnerability has been resolved in the Linux kernel by properly setting the nPMZR_EL0 trap bit and handling PMZR_EL0 writes correctly. Users should apply the official Linux kernel update that includes this fix. Patch status is not explicitly stated in the input data; therefore, check the vendor advisory for current remediation guidance.