powerpc/hv-gpci: fix preempt count leak in sysfs show paths (Linux Linux)
En bref
- Source
- NVD
- EPSS
- EPSS 0.12 % · centile 2 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- Linux
- Statut NVD
- Analyzed
Description
In the Linux kernel, the following vulnerability has been resolved: powerpc/hv-gpci: fix preempt count leak in sysfs show paths Four sysfs show() callbacks in hv-gpci take get_cpu_var(hv_gpci_reqb) (which calls preempt_disable()) but only call the matching put_cpu_var() on the error path under the 'out:' label. Every successful read leaks one preempt_disable(): processor_bus_topology_show() processor_config_show() affinity_domain_via_virtual_processor_show() affinity_domain_via_domain_show() (affinity_domain_via_partition_show() was already correct.) On a CONFIG_PREEMPT=y kernel, repeated reads raise preempt_count and eventually return to userspace with preemption still disabled. The next user-mode page fault then hits faulthandler_disabled() == 1, gets forced to SIGSEGV, and the resulting coredump trips 'BUG: scheduling while atomic' in call_usermodehelper_exec -> wait_for_completion_state -> schedule: BUG: scheduling while atomic: <task>/<pid>/0x00000004 ... __schedule_bug+0x6c/0x90 __schedule+0x58c/0x13a0 schedule+0x48/0x1a0 schedule_timeout+0x104/0x170 wait_for_completion_state+0x16c/0x330 call_usermodehelper_exec+0x254/0x2d0 vfs_coredump+0x1050/0x2590 get_signal+0xb9c/0xc80 do_notify_resume+0xf8/0x470 Add an out_success label that calls put_cpu_var() before returning the byte count, mirroring affinity_domain_via_partition_show().
Références
- https://git.kernel.org/stable/c/b300312562fd6e4729697adb9f777f00ca0429f3
- https://git.kernel.org/stable/c/45afabe7f99c5d8746434ee41c86584c01d70147
- https://git.kernel.org/stable/c/b61ebb2826ca1852c2bbd92a676fb622c358cab4
- https://git.kernel.org/stable/c/903409000a07ac8e31ffedeb8516f4f8d67150c8
- https://git.kernel.org/stable/c/dbc30a57bd8e026995e9fa8e8c31cffd18542c01
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2026-45643
- GCVE · GCVE-0-2026-64070
Avis du CERT-FR
- CERTFR-2026-AVI-1432 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1372 — Multiples vulnérabilités dans les produits SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1289 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1253 — Multiples vulnérabilités dans le noyau Linux de Debian · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1252 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1229 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1162 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1066 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0954 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0926 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.6 < 6.6.156cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.7 < 6.12.108cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.13 < 6.18.49cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.19 < 7.0.11cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| Linux · Linux | affected 71f1c39647d8c9d4d54a861ec81f1ff17544bcb6 < b300312562fd6e4729697adb9f777f00ca0429f3 ; affected 71f1c39647d8c9d4d54a861ec81f1ff17544bcb6 < 45afabe7f99c5d8746434ee41c86584c01d70147 ; affected 71f1c39647d8c9d4d54a861ec81f1ff17544bcb6 < b61ebb2826ca1852c2bbd92a676fb622c358cab4 ; affected 71f1c39647d8c9d4d54a861ec81f1ff17544bcb6 < 903409000a07ac8e31ffedeb8516f4f8d67150c8 ; affected 71f1c39647d8c9d4d54a861ec81f1ff17544bcb6 < dbc30a57bd8e026995e9fa8e8c31cffd18542c01 |
| Linux · Linux | affected 6.6 ; unaffected 0 < 6.6 ; unaffected 6.6.156 ≤ 6.6.* ; unaffected 6.12.108 ≤ 6.12.* ; unaffected 6.18.49 ≤ 6.18.* ; unaffected 7.0.11 ≤ 7.0.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |