CVE-2026-93254
Estado: RecibidaSin puntuar—
In the Linux kernel, the following vulnerability has been resolved:
arm64: entry: Avoid unnecessary local_irq_disable() on kernel exit
Currently, when exiting to kernel mode, we attempt involuntary preemption. The preemption logic expects IRQs to be disabled, which is why we call local_irq_disable() before attempting preemption.
However, depending on the context, local_irq_disable() may be unnecessary:
Furthermore, it confuses the pNMI state tracking when we are in a context with interrupts disabled and the GIC_PRIO_PSR_I_SET bit is set in the PMR, leading to a warning when CONFIG_ARM64_DEBUG_PRIORITY_MASKING=y:
Leer descripción completaMostrar menos
Split arm64_exit_to_kernel_mode() into preempt, non-preempt, and dispatch parts so that we can avoid this extra work where it is not needed and avoid breaking the pNMI tracking logic.
Detalles técnicos trazas, registros y código del informe original
- __el1_irq(), the non-NMI EL1 IRQ path, already has IRQs disabled, so
local_irq_disable() is redundant.
- irqentry_exit_to_kernel_mode_preempt() immediately returns when
exiting from an NMI-like context, so calling local_irq_disable()
beforehand is unnecessary work.
WARNING: ./arch/arm64/include/asm/irqflags.h:63 at arm64_exit_to_kernel_mode+0xb8/0xc0, CPU#40: retsnoop/31805
CPU: 40 UID: 0 PID: 31805 Comm: retsnoop Not tainted 7.2.0-rc6-next-20260805 #7 PREEMPTLAZY
pstate: 234013c9 (nzCv DAIF +PAN -UAO +TCO +DIT +SSBS BTYPE=--)
pc : arm64_exit_to_kernel_mode (arch/arm64/kernel/entry-common.c:63)
lr : el1_abort (arch/arm64/kernel/entry-common.c:323)
pmr: 000000f0
Call trace:
arm64_exit_to_kernel_mode (arch/arm64/kernel/entry-common.c:63) (P)
el1_abort (arch/arm64/kernel/entry-common.c:323)
el1h_64_sync_handler (arch/arm64/kernel/entry-common.c:449)
el1h_64_sync (arch/arm64/kernel/entry.S:589)
[...]CVSS
NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.21%
- Percentil entre todas las CVEs puntuadas: 10
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-93254",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "ae654112eac05f316ef31587fc55e4d7160d0086",
"lessThan": "49a61174186bed25d439ff37400c7ce5e3603e73",
"versionType": "git"
},
{
"status": "affected",
"version": "ae654112eac05f316ef31587fc55e4d7160d0086",
"lessThan": "39aebe0e89469c2904e60b1e977e0d4dbf33326b",
"versionType": "git"
}
],
"programFiles": [
"arch/arm64/kernel/entry-common.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "7.1"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "7.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"arch/arm64/kernel/entry-common.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-09-24T16:17:21.807",
"references": [
{
"url": "https://git.kernel.org/stable/c/39aebe0e89469c2904e60b1e977e0d4dbf33326b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/49a61174186bed25d439ff37400c7ce5e3603e73",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: entry: Avoid unnecessary local_irq_disable() on kernel exit\n\nCurrently, when exiting to kernel mode, we attempt involuntary\npreemption. The preemption logic expects IRQs to be disabled, which is\nwhy we call local_irq_disable() before attempting preemption.\n\nHowever, depending on the context, local_irq_disable() may be\nunnecessary:\n\n- __el1_irq(), the non-NMI EL1 IRQ path, already has IRQs disabled, so\n local_irq_disable() is redundant.\n\n- irqentry_exit_to_kernel_mode_preempt() immediately returns when\n exiting from an NMI-like context, so calling local_irq_disable()\n beforehand is unnecessary work.\n\nFurthermore, it confuses the pNMI state tracking when we are in a\ncontext with interrupts disabled and the GIC_PRIO_PSR_I_SET bit is set\nin the PMR, leading to a warning when\nCONFIG_ARM64_DEBUG_PRIORITY_MASKING=y:\n\n WARNING: ./arch/arm64/include/asm/irqflags.h:63 at arm64_exit_to_kernel_mode+0xb8/0xc0, CPU#40: retsnoop/31805\n CPU: 40 UID: 0 PID: 31805 Comm: retsnoop Not tainted 7.2.0-rc6-next-20260805 #7 PREEMPTLAZY\n pstate: 234013c9 (nzCv DAIF +PAN -UAO +TCO +DIT +SSBS BTYPE=--)\n pc : arm64_exit_to_kernel_mode (arch/arm64/kernel/entry-common.c:63)\n lr : el1_abort (arch/arm64/kernel/entry-common.c:323)\n pmr: 000000f0\n Call trace:\n arm64_exit_to_kernel_mode (arch/arm64/kernel/entry-common.c:63) (P)\n el1_abort (arch/arm64/kernel/entry-common.c:323)\n el1h_64_sync_handler (arch/arm64/kernel/entry-common.c:449)\n el1h_64_sync (arch/arm64/kernel/entry.S:589)\n [...]\n\nSplit arm64_exit_to_kernel_mode() into preempt, non-preempt, and\ndispatch parts so that we can avoid this extra work where it is not\nneeded and avoid breaking the pNMI tracking logic."
}
],
"lastModified": "2026-09-24T16:17:21.807",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}