CVE-2026-98546

In the Linux kernel, the following vulnerability has been resolved:

arm64/boot: Disable trapping of PMZR EL0 writes to EL2

init el2 fgt2() writes one mask to both HDFGRTR2 EL2 and HDFGWTR2 EL2. PMZR EL0 is write-only, so its trap bit, nPMZR EL0, exists only in HDFGWTR2 EL2 and is therefore never set: a PMZR EL0 write from the host traps to EL2, where the nVHE hypervisor has no handler and BUG()s. The kernel never writes PMZR EL0, but kernel.perf user access=1 has the PMU driver set PMUSERENR EL0.UEN for a task with a user-read event, so a write from EL0 reaches the trap and takes the host down without a panic message.

Accumulate the HDFGWTR2 EL2 bits separately, as init el2 fgt() already does for HDFGWTR EL2, and set nPMZR EL0 with the other FEAT PMUv3p9 bits.