arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.17 % · percentile 7 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Received
Description
In the Linux kernel, the following vulnerability has been resolved: arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc swsusp_arch_suspend_exit() reinstalls the restored kernel's hyp stub vectors with an hvc, but never passes the arguments. x0 is not set to HVC_SET_VECTORS and x1 is not set to the vector address, so the stub dispatch falls through and returns without writing vbar_el2. EL2 is left pointing at the trans_pgd copy of the vectors, a page that swsusp_free() releases right after resume. Set the arguments up the same way __hyp_set_vectors() does. Without this fix, Vladimir was able to trigger a hang when resuming from hibernation with CONFIG_PAGE_POISONING=y and page_poison=on.
References
- https://git.kernel.org/stable/c/6646418d1032cac25110526161f60d255ed08397
- https://git.kernel.org/stable/c/909e92423db7299e0206232051aa21fe129f65d0
- https://git.kernel.org/stable/c/60a3c319f1127c4d247d4ed235c5d65376d5e745
- https://git.kernel.org/stable/c/e80ea8118a073a30ebe7a31bd78938c2b1751acc
- https://git.kernel.org/stable/c/d3f8f773312af69eaf4dda106d76d6d42e4362e5
- https://git.kernel.org/stable/c/955d86e5f3b95b731991fdb84966c50b16314629
European references
- ENISA EUVD · EUVD-2026-93177
- GCVE · GCVE-0-2026-98249
CERT-FR advisories
- CERTFR-2026-AVI-1385 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1375 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1374 — Multiples vulnérabilités dans le noyau Linux de Debian · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected 788bfdd97434982b6d575062581e8e72eea755af < 6646418d1032cac25110526161f60d255ed08397 ; affected 788bfdd97434982b6d575062581e8e72eea755af < 909e92423db7299e0206232051aa21fe129f65d0 ; affected 788bfdd97434982b6d575062581e8e72eea755af < 60a3c319f1127c4d247d4ed235c5d65376d5e745 ; affected 788bfdd97434982b6d575062581e8e72eea755af < e80ea8118a073a30ebe7a31bd78938c2b1751acc ; affected 788bfdd97434982b6d575062581e8e72eea755af < d3f8f773312af69eaf4dda106d76d6d42e4362e5 ; affected 788bfdd97434982b6d575062581e8e72eea755af < 955d86e5f3b95b731991fdb84966c50b16314629 |
| Linux · Linux | affected 5.16 ; unaffected 0 < 5.16 ; unaffected 6.1.189 ≤ 6.1.* ; unaffected 6.6.158 ≤ 6.6.* ; unaffected 6.12.112 ≤ 6.12.* ; unaffected 6.18.54 ≤ 6.18.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |