Skip to main content

Linux Kernel CVE-2026-64214

| EUVDEUVD-2026-48622 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-07-24 Linux GHSA-5qjx-3f5w-qj49
Null Pointer Dereference Denial Of Service Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
4.1 MEDIUM

Real-mode MCE context requires kernel-level execution (PR:H) and a hardware-specific trigger condition (AC:H); no confidentiality or integrity impact applies.

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 11, 2026 - 22:01 vuln.today
CVSS changed
Aug 11, 2026 - 17:22 NVD
5.5 (MEDIUM)
Patch available
Jul 24, 2026 - 17:48 EUVD
CVE Published
Jul 24, 2026 - 15:23 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 24, 2026 - 15:23 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise()

A kernel panic is observed when handling machine check exceptions from real mode.

BUG: Unable to handle kernel data access on read at 0xc00000006be21300 Oops: Kernel access of bad area, sig: 11 [#1] MSR: 8000000000001003 <SF,ME,RI,LE> CR: 88222248 XER: 00000005 CFAR: c00000000003ffc4 DAR: c00000006be21300 DSISR: 40000000 IRQMASK: 0 NIP [c000000000029e40] arch_irq_work_raise+0x10/0x70 LR [c00000000003ffc8] machine_check_queue_event+0xa8/0x150 Call Trace: [c0000000179d3c70] [c00000000003ff64] machine_check_queue_event+0x44/0x150 [c0000000179d3d30] [c0000000000084e0] machine_check_early_common+0x1f0/0x2c0

The crash occurs because arch_irq_work_raise() calls preempt_disable() from machine check exception (MCE) handlers running in real mode. In this context, accessing the preempt_count can fault, leading to the panic.

The preempt_disable()/preempt_enable() pair in arch_irq_work_raise() was originally added by commit 0fe1ac48bef0 ("powerpc/perf_event: Fix oops due to perf_event_do_pending call") to avoid races while raising irq work from exception context.

Later, commit 471ba0e686cb ("irq_work: Do not raise an IPI when queueing work on the local CPU") added preemption protection in irq_work_queue() path, while commit 20b876918c06 ("irq_work: Use per cpu atomics instead of regular atomics") added equivalent protection in irq_work_queue_on() before reaching arch_irq_work_raise():

irq_work_queue() / irq_work_queue_on() -> preempt_disable() -> __irq_work_queue_local() -> irq_work_raise() -> arch_irq_work_raise()

As a result, callers other than mce_irq_work_raise() already execute with preemption disabled, making the additional preempt_disable()/preempt_enable() pair in arch_irq_work_raise() redundant.

The arch_irq_work_raise() function executes in NMI context when called from MCE handler. Hence we will not be preempted or scheduled out since we are in NMI context with MSR[EE]=0. Therefore, it is safe to remove the preempt_disable()/preempt_enable() calls from here.

Remove it to avoid accessing preempt_count from real mode context.

[Maddy: Fixed the commit title]

AnalysisAI

Kernel panic in the Linux kernel's PowerPC-specific arch_irq_work_raise() function crashes affected systems when machine check exception handlers invoke the function from real mode, a context where virtual memory translation is disabled and preempt_count access via a virtual address faults with a bad area data access error. PowerPC deployments running kernel versions prior to 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, and 7.1 are affected; x86, ARM, and other non-PowerPC architectures are completely unaffected. No public exploit code exists and EPSS is 0.17% (7th percentile), consistent with a hardware-architecture-specific reliability defect rather than an attacker-driven threat; the vulnerability does not appear in the CISA KEV catalog.

Technical ContextAI

The Linux kernel on PowerPC (ppc64) implements irq_work - a mechanism to defer work items from NMI and interrupt contexts - via arch_irq_work_raise(), which triggers a self-IPI to process queued work. The function historically included preempt_disable()/preempt_enable() calls (introduced in commit 0fe1ac48bef0) to prevent races when raising irq work from exception context. Subsequent upstream changes - commits 471ba0e686cb and 20b876918c06 - moved preemption protection earlier in the irq_work_queue() and irq_work_queue_on() call chains, making those calls in arch_irq_work_raise() redundant for all normal callers. However, machine check exception (MCE) handlers call arch_irq_work_raise() from real mode (MSR[DR]=0, MMU-backed virtual translation off), a distinct NMI context. In real mode, preempt_count is stored at a virtual address that is not reachable without active MMU translation; accessing it triggers a kernel data bad area fault (DSISR: 40000000 at the mapped address). CWE-476 (Null Pointer Dereference) is the assigned root cause class, reflecting the invalid memory dereference, though the precise mechanism is a real-mode virtual address access fault rather than a strict null pointer. CPE data (cpe:2.3:a:linux:linux) confirms all Linux kernel versions prior to the stable-branch patch commits across multiple maintained branches are affected.

RemediationAI

Upgrade to a patched kernel version appropriate to the active stable branch: 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, or 7.1. Individual fix commits for each stable branch are available at git.kernel.org (see references: 51860e423592893cd7bfa7287d99a3aff4dc3a9d and siblings). Ubuntu users should apply updates per USN-8618-1 at https://ubuntu.com/security/notices/USN-8618-1. For PowerPC systems where an immediate kernel upgrade is not feasible, reducing the frequency of hardware events that generate machine check exceptions (maintaining hardware health, ECC memory, stable hardware configurations) lowers the probability of hitting the panic but does not eliminate the code path vulnerability. There is no software workaround that removes the vulnerable preempt_count access without applying the patch. Normal maintenance patch scheduling is appropriate given the low exploitation risk.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Null Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-64214 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy