Skip to main content

Linux Kernel CVE-2026-64070

| EUVDEUVD-2026-45643 MEDIUM
2026-07-19 Linux GHSA-h8p2-7w9q-6g4f
Denial Of Service Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local unprivileged sysfs read triggers the bug; no data exposed and no integrity impact, only availability degradation through eventual kernel panic.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

6
Metadata Corrected
Sep 03, 2026 - 15:40 vuln.today
tag: Information Disclosure replaced by Denial Of Service
Analysis Generated
Sep 03, 2026 - 15:25 vuln.today
CVSS changed
Sep 03, 2026 - 15:22 NVD
5.5 (MEDIUM)
Patch available
Jul 19, 2026 - 17:03 EUVD
CVE Published
Jul 19, 2026 - 15:39 nvd
MEDIUM 5.5
CVE Published
Jul 19, 2026 - 15:39 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

powerpc/hv-gpci: fix preempt count leak in sysfs show paths

Four sysfs show() callbacks in hv-gpci take get_cpu_var(hv_gpci_reqb) (which calls preempt_disable()) but only call the matching put_cpu_var() on the error path under the 'out:' label. Every successful read leaks one preempt_disable():

processor_bus_topology_show() processor_config_show() affinity_domain_via_virtual_processor_show() affinity_domain_via_domain_show()

(affinity_domain_via_partition_show() was already correct.)

On a CONFIG_PREEMPT=y kernel, repeated reads raise preempt_count and eventually return to userspace with preemption still disabled. The next user-mode page fault then hits faulthandler_disabled() == 1, gets forced to SIGSEGV, and the resulting coredump trips 'BUG: scheduling while atomic' in call_usermodehelper_exec -> wait_for_completion_state -> schedule:

BUG: scheduling while atomic: <task>/<pid>/0x00000004 ... __schedule_bug+0x6c/0x90 __schedule+0x58c/0x13a0 schedule+0x48/0x1a0 schedule_timeout+0x104/0x170 wait_for_completion_state+0x16c/0x330 call_usermodehelper_exec+0x254/0x2d0 vfs_coredump+0x1050/0x2590 get_signal+0xb9c/0xc80 do_notify_resume+0xf8/0x470

Add an out_success label that calls put_cpu_var() before returning the byte count, mirroring affinity_domain_via_partition_show().

AnalysisAI

Preempt count leak in four hv-gpci sysfs show() callbacks in the Linux kernel powerpc subsystem causes progressive kernel stability degradation on IBM Power systems compiled with CONFIG_PREEMPT=y. Each successful read of the affected sysfs nodes leaves one preempt_disable() unmatched, incrementally raising preempt_count; once the count becomes non-zero on return to userspace, the next page fault is misidentified as occurring in an atomic context, generating SIGSEGV and triggering 'BUG: scheduling while atomic' during the resulting coredump. Patches are available across the 6.6, 7.0, and 7.1 stable kernel trees, with no public exploit identified at time of analysis.

Technical ContextAI

The hv-gpci (Hypervisor Generic Platform Counter Interface) driver in the Linux kernel powerpc subsystem exposes IBM PowerVM performance counter data through sysfs. The four affected callbacks - processor_bus_topology_show(), processor_config_show(), affinity_domain_via_virtual_processor_show(), and affinity_domain_via_domain_show() - obtain a per-CPU buffer via get_cpu_var(hv_gpci_reqb), which internally calls preempt_disable() to pin execution to the current CPU. The symmetric put_cpu_var() call, which re-enables preemption, was present only under the error-path 'out:' label, leaving the disable/enable pair unbalanced on every successful return. No CWE is assigned, but this maps to an improper resource cleanup pattern. The effect is observable only on CONFIG_PREEMPT=y kernels; on non-preemptible builds, the imbalanced count has no runtime consequence. A fifth callback, affinity_domain_via_partition_show(), was already implemented correctly and is unaffected.

RemediationAI

Apply the upstream stable-tree fixes: commit 45afabe7f99c5d8746434ee41c86584c01d70147 (https://git.kernel.org/stable/c/45afabe7f99c5d8746434ee41c86584c01d70147), b300312562fd6e4729697adb9f777f00ca0429f3 (https://git.kernel.org/stable/c/b300312562fd6e4729697adb9f777f00ca0429f3), and b61ebb2826ca1852c2bbd92a676fb622c358cab4 (https://git.kernel.org/stable/c/b61ebb2826ca1852c2bbd92a676fb622c358cab4). For Linux 7.0, upgrade to 7.0.11 or later; for 7.1, apply commit dbc30a57bd8e or 903409000a07. Ubuntu users should apply packages from USN-8593-1 (https://ubuntu.com/security/notices/USN-8593-1). If immediate kernel update is not feasible on affected IBM Power environments, restrict read access to the hv-gpci sysfs performance counter nodes via filesystem permissions or seccomp/LSM policy, preventing unprivileged accumulation of the imbalance - note this will disable access to the associated performance counter data for non-root users.

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-64070 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy