Skip to main content

Linux Kernel EUVDEUVD-2026-86132

| CVE-2026-93260 HIGH
2026-09-24 Linux GHSA-q6qm-qq42-2gwg
Linux
7.4
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Local presence on PowerPC/POWER host
  2. Delivery
    Induce XIVE IPI init/alloc failure
  3. Exploit
    Error path frees xive_ipis array
  4. Execution
    Boot proceeds to xive_setup_cpu_ipi()
  5. Persist
    Dereference of freed pointer (UAF)
  6. Impact
    Kernel memory corruption / crash

Vulnerability Assessment

Exploitation Conditions

Exploitation is confined to Linux systems running on PowerPC hardware that use the XIVE interrupt controller (POWER9/POWER10-class), during SMP boot/CPU bring-up. The use-after-free is only reachable when xive_init_ipis() fails - specifically when irq_domain_alloc_irqs() fails to allocate IPI interrupts - which is a kernel initialization failure condition, not a request-driven code path an attacker feeds input to. Limiting factors: the affected code executes only at boot/probe time (xive_smp_probe → xive_setup_cpu_ipi), the platform must be PowerPC (no x86/ARM exposure), the allocation-failure precondition is difficult to force externally (AC:H), and there is no evidence the trigger is attacker-controllable, which sharply constrains realistic exploitation to DoS/crash under resource-starvation conditions.
Impact

Despite a CVSS base score of 7.4, the real-world risk of this Linux kernel powerpc/xive use-after-free is low. The provided vector (AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) correctly captures local-only reach and high complexity, but the trigger condition - xive_init_ipis()/irq_domain_alloc_irqs() failing during SMP boot probe - is a kernel initialization error path, not an attacker-controllable input surface. There is no EPSS score, no CISA KEV listing, and no public exploit code, so the signals are consistent: this is a defensive robustness/error-handling hardening fix, not an actively exploited flaw. The description implies the UAF is only reached when IPI allocation genuinely fails at boot, which an unprivileged remote or even local attacker cannot readily force, so the PR:N/C:H/I:H/A:H impact rating overstates practical exploitability - the realistic outcome is a crash/DoS rather than reliable code execution. Note also this affects only the PowerPC XIVE interrupt controller, further narrowing exposure. Treat as low-priority to patch on non-PowerPC systems (not applicable) and routine-priority on POWER hardware.
Exploit ScenarioDerived

On a PowerPC POWER9/POWER10 system, if XIVE IPI initialization fails during SMP bring-up (e.g. irq_domain_alloc_irqs() fails), the error path frees the global xive_ipis array yet boot continues into xive_setup_cpu_ipi(), which dereferences the freed pointer, causing a use-after-free in the kernel. Exploitation is not straightforward: the AC:H rating and boot-time-only error path mean an attacker cannot easily induce the required allocation failure, and no public proof-of-concept exists at time of analysis.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 25, 2026

Use-after-free in the Linux kernel's powerpc/xive interrupt-controller code can crash or corrupt memory on PowerPC systems (POWER9/POWER10-class) that use the XIVE interrupt controller for SMP CPU bring-up, when the global xive_ipis array is freed after a failed xive_init_ipis() call and then dereferenced by xive_setup_cpu_ipi(). Only PowerPC hardware running the affected kernel is exposed; x86, ARM and other architectures are unaffected, and per the authoritative assessment the trigger is a kernel initialization failure (irq_domain_alloc_irqs() failing) reached at boot/probe time with local access and low privileges (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H), so despite the higher vendor base score of 7.4 the realistic risk is low and exploitation is effectively confined to denial of service/crash under resource-starvation conditions. No public exploit code exists and there is no confirmed active exploitation (not listed in CISA KEV); the flaw is addressed in the upstream stable commits c554a8d376d5aea1b237ed6bef6f9fbfc550e67f and 411a3c016e7a95f5fa105a0587e07d0647a77727, which correspond to the Linux 7.2.6 stable release and the 7.3-rc1 merge window fix.

RemediationAI

Vendor-released patch: Linux 7.2.6 (stable backport c554a8d376d5aea1b237ed6bef6f9fbfc550e67f) and Linux 7.3-rc1 (mainline fix 411a3c016e7a95f5fa105a0587e07d0647a77727); upgrade PowerPC kernels to those or later versions, or apply the corresponding distribution kernel update once the distributor has backported the commits - see https://git.kernel.org/stable/c/c554a8d376d5aea1b237ed6bef6f9fbfc550e67f, https://git.kernel.org/stable/c/411a3c016e7a95f5fa105a0587e07d0647a77727 and the tracking record https://nvd.nist.gov/vuln/detail/CVE-2026-93260. Because the faulting code runs only during xive_smp_probe() (boot and CPU bring-up) and only after irq_domain_alloc_irqs() fails, there is no userspace input to sanitize and no request-level filter to apply; the practical compensating controls are therefore scheduling and configuration based. First, avoid unnecessary CPU hotplug/add-CPU operations on PowerPC XIVE systems that have not yet been patched, since each bring-up re-runs the vulnerable probe path - the trade-off is reduced dynamic capacity scaling and slower recovery from CPU offlining. Second, where the workload permits, booting with a reduced CPU count (for example nr_cpus=1) removes concurrent SMP bring-up on that node, at the cost of significant performance loss on POWER9/POWER10 servers. Third, reduce the chance of the initiating allocation failure by preventing memory pressure on the irq_domain allocation at boot and during hotplug (do not over-commit memory, avoid aggressive early-boot memory restriction), acknowledging that this is a probabilistic mitigation and cannot be relied on. Finally, restrict local login/privilege on affected PowerPC hosts to trusted operators, since the assessed vector requires local access with low privileges (PR:L); this does not address a kernel-initiated failure but removes the low-privilege local actor component. If a system can be configured to use the older XICS interrupt controller instead of XIVE for its interrupt delivery, that removes the affected code path entirely, but it changes platform firmware/guest configuration, may not be supported on POWER9/POWER10 hardware or KVM guests, and can impact performance and feature availability - validate in a test environment before rolling out. No public exploit code exists and there is no confirmed active exploitation (not in CISA KEV), so patching can follow normal maintenance windows rather than emergency change control, but hosts that must remain on PowerPC XIVE boot paths should be prioritized.

Affected VersionsENISA

Linux patch: 7.2.6
Linux 243e25112d06b348f087a6f7aba4bbc288285bdd <c554a8d376d5aea1b237ed6bef6f9fbfc550e67f
Linux 4.12
Linux patch: 7.3-rc1
Linux patch: 0
Linux 243e25112d06b348f087a6f7aba4bbc288285bdd <411a3c016e7a95f5fa105a0587e07d0647a77727

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The XIVE (eXternal Interrupt Virtualization Engine) is the interrupt controller used by IBM POWER9/POWER10-class PowerPC processors; the powerpc/xive driver initializes a global array, xive_ipis, that holds per-CPU inter-processor interrupt (IPI) descriptors allocated through the generic irq_domain_alloc_irqs() infrastructure. During SMP bring-up the platform hooks pnv_smp_probe() (PowerNV) and pSeries_smp_probe() (pSeries/LPAR) call xive_smp_probe(), which in the vulnerable code returned void and therefore ignored the failure of xive_init_ipis(). When xive_init_ipis() fails, its error path frees the global xive_ipis array, but execution continues into xive_setup_cpu_ipi(), which dereferences the now-dangling xive_ipis pointer - a classic use-after-free. The underlying defect class is a use-after-free of a global kernel pointer (CWE-416); the upstream data does not assign a CWE, so the identifier is inferred from the reported root cause rather than taken from the advisory. The fix changes xive_smp_probe() to return int (building on the preceding preparatory patch) and propagates errors from both xive_init_ipis() and xive_setup_cpu_ipi() back to the callers, so pnv_smp_probe() and pSeries_smp_probe() now check the return value and abort IPI setup cleanly instead of touching freed memory. Because the dereference occurs in the boot/CPU-hotplug probe path and the freeing precondition is a failure of interrupt allocation, the exploitable surface is not a request-driven path that an attacker can feed input to - it is reached only when the kernel itself fails during interrupt-domain allocation, which is why the assessed vector (AC:H, PR:L, C:L/I:L/A:H) is materially narrower than the published 7.4 base score. Affected product identifiers in the source data are generic Linux kernel CPEs (cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*), reflecting that the exposure is a kernel subsystem on a specific architecture rather than a separately versioned product.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.4 HIGH
AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 5.8 MEDIUM

Local PowerPC boot-path only, requiring low-priv local influence to induce IPI alloc failure (PR:L, AC:H); UAF most plausibly yields crash/DoS (A:H) with limited C/I.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE 4.4 MEDIUM
AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Sep 25, 2026 - 05:23 NVD
7.4 (HIGH)
Patch available
Sep 24, 2026 - 17:18 EUVD
CVE Published
Sep 24, 2026 - 15:51 cve.org
HIGH 7.4
CVE Published
Sep 24, 2026 - 15:51 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

powerpc/xive: propagate IPI init errors to prevent use-after-free

When xive_init_ipis() fails (e.g. irq_domain_alloc_irqs() fails), the error path frees the global xive_ipis array. However, xive_smp_probe() previously ignored this failure and proceeded to call xive_setup_cpu_ipi(), which dereferences the already-freed xive_ipis pointer -- a use-after-free.

Now that xive_smp_probe() returns int (previous patch), propagate the error from xive_init_ipis() and xive_setup_cpu_ipi() through xive_smp_probe(). Check the return value in both pnv_smp_probe() and pSeries_smp_probe() so that IPI setup is aborted cleanly on failure, avoiding the use-after-free.

Executive ViewAI

Why It Matters

A use-after-free flaw in the Linux kernel's PowerPC XIVE interrupt-controller code (CVE-2026-93260, CVSS 7.4) can crash or corrupt memory on POWER9/POWER10-class servers during CPU bring-up. Exposure is confined to PowerPC hardware running the affected kernel and requires local, low-privileged (authenticated) access combined with a specific initialization failure, so organizational impact is limited to availability loss on a narrow slice of infrastructure. A patch is available per the vendor advisory, and no public exploit identified at time of analysis or confirmed actively exploited (CISA KEV), so this should be handled as routine maintenance rather than an emergency.

Business Impact: Low
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.1%
Top 98% exploitable
Prevalence
Low
vulnerable code is PowerPC-only XIVE subsystem; niche hardware footprint despite Linux ubiquity
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
Low

Priority Score

37
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +37
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-93260 ADVISORY https://vuldb.com/vuln/409709 REF https://git.kernel.org/stable/c/2ea6238343691309e68308131c7e80c3ae05afea REF https://git.kernel.org/stable/c/411a3c016e7a95f5fa105a0587e07d0647a77727 REF https://git.kernel.org/stable/c/5c9ab0c9cede9f149733d330e2d7d45341b71359 REF https://git.kernel.org/stable/c/c554a8d376d5aea1b237ed6bef6f9fbfc550e67f REF https://git.kernel.org/stable/c/e36b1c2eafcaaddefa70d55e6fda74cf6cda38af

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy