Linux Kernel CVE-2026-93260

Vendor-released patch: Linux 7.2.6 (stable backport c554a8d376d5aea1b237ed6bef6f9fbfc550e67f) and Linux 7.3-rc1 (mainline fix 411a3c016e7a95f5fa105a0587e07d0647a77727); upgrade PowerPC kernels to those or later versions, or apply the corresponding distribution kernel update once the distributor has backported the commits - see https://git.kernel.org/stable/c/c554a8d376d5aea1b237ed6bef6f9fbfc550e67f, https://git.kernel.org/stable/c/411a3c016e7a95f5fa105a0587e07d0647a77727 and the tracking record https://nvd.nist.gov/vuln/detail/CVE-2026-93260. Because the faulting code runs only during xive_smp_probe() (boot and CPU bring-up) and only after irq_domain_alloc_irqs() fails, there is no userspace input to sanitize and no request-level filter to apply; the practical compensating controls are therefore scheduling and configuration based. First, avoid unnecessary CPU hotplug/add-CPU operations on PowerPC XIVE systems that have not yet been patched, since each bring-up re-runs the vulnerable probe path - the trade-off is reduced dynamic capacity scaling and slower recovery from CPU offlining. Second, where the workload permits, booting with a reduced CPU count (for example nr_cpus=1) removes concurrent SMP bring-up on that node, at the cost of significant performance loss on POWER9/POWER10 servers. Third, reduce the chance of the initiating allocation failure by preventing memory pressure on the irq_domain allocation at boot and during hotplug (do not over-commit memory, avoid aggressive early-boot memory restriction), acknowledging that this is a probabilistic mitigation and cannot be relied on. Finally, restrict local login/privilege on affected PowerPC hosts to trusted operators, since the assessed vector requires local access with low privileges (PR:L); this does not address a kernel-initiated failure but removes the low-privilege local actor component. If a system can be configured to use the older XICS interrupt controller instead of XIVE for its interrupt delivery, that removes the affected code path entirely, but it changes platform firmware/guest configuration, may not be supported on POWER9/POWER10 hardware or KVM guests, and can impact performance and feature availability - validate in a test environment before rolling out. No public exploit code exists and there is no confirmed active exploitation (not in CISA KEV), so patching can follow normal maintenance windows rather than emergency change control, but hosts that must remain on PowerPC XIVE boot paths should be prioritized.