PT-2026-64329 · Linux · Linux
CVE-2026-64214
·
Published
2026-07-24
·
Updated
2026-07-24
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
powerpc/time: Remove redundant preempt disable|enable() calls from arch irq work raise()
A kernel panic is observed when handling machine check exceptions from
real mode.
BUG: Unable to handle kernel data access on read at 0xc00000006be21300
Oops: Kernel access of bad area, sig: 11 [#1]
MSR: 8000000000001003 <SF,ME,RI,LE> CR: 88222248 XER: 00000005
CFAR: c00000000003ffc4 DAR: c00000006be21300 DSISR: 40000000 IRQMASK: 0
NIP [c000000000029e40] arch irq work raise+0x10/0x70
LR [c00000000003ffc8] machine check queue event+0xa8/0x150
Call Trace:
[c0000000179d3c70] [c00000000003ff64] machine check queue event+0x44/0x150
[c0000000179d3d30] [c0000000000084e0] machine check early common+0x1f0/0x2c0
The crash occurs because arch irq work raise() calls preempt disable()
from machine check exception (MCE) handlers running in real mode. In
this context, accessing the preempt count can fault, leading to the panic.
The preempt disable()/preempt enable() pair in arch irq work raise()
was originally added by commit 0fe1ac48bef0 ("powerpc/perf event: Fix
oops due to perf event do pending call") to avoid races while raising
irq work from exception context.
Later, commit 471ba0e686cb ("irq work: Do not raise an IPI when
queueing work on the local CPU") added preemption protection in
irq work queue() path, while commit 20b876918c06 ("irq work: Use per
cpu atomics instead of regular atomics") added equivalent
protection in irq work queue on() before reaching arch irq work raise():
irq work queue() / irq work queue on()
-> preempt disable()
-> irq work queue local()
-> irq work raise()
-> arch irq work raise()
As a result, callers other than mce irq work raise() already execute
with preemption disabled, making the additional
preempt disable()/preempt enable() pair in arch irq work raise()
redundant.
The arch irq work raise() function executes in NMI context when called
from MCE handler. Hence we will not be preempted or scheduled out since
we are in NMI context with MSR[EE]=0. Therefore, it is safe to remove
the preempt disable()/preempt enable() calls from here.
Remove it to avoid accessing preempt count from real mode context.
[Maddy: Fixed the commit title]
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux