CVE-2026-93259
In the Linux kernel, the following vulnerability has been resolved:
powerpc/irq: Fix missing r2 clobber in PCREL inline assembly
In CONFIG_PPC_KERNEL_PCREL mode, r2 is no longer reserved for the TOC pointer and is available as a caller-saved register [0].
Both call_do_irq() and call_do_softirq() use inline assembly to call functions with stack switching, but fail to list r2 in their clobber lists. This causes the compiler to assume r2 is preserved across these calls, leading to register corruption when the called functions (__do_irq and __do_softirq) clobber r2.
As a result of this kernel crash during interrupt handling is seen and the kernel fails to boot:
Leer descripción completaMostrar menos
With older GCC, the compiler would conservatively allocate callee-saved registers (like r31) for values spanning function calls, accidentally avoiding the bug:
<__do_IRQ>: 00 00 00 60 nop a6 02 08 7c mflr r0 f8 ff e1 fb std r31,-8(r1) f0 ff c1 fb std r30,-16(r1) 2d 03 10 06 pla r31,53297316
...
3d e8 ff 4b bl c0000000000165ac <__do_irq> 00 00 21 e8 ld r1,0(r1) 28 00 4d e9 ld r10,40(r13) 40 00 21 38 addi r1,r1,64 2a f9 aa 7f stdx r29,r10,r31
With newer GCC 14, the compiler uses r2 for such values, exposing the missing clobber specification:
<__do_IRQ>: 00 00 00 60 nop a6 02 08 7c mflr r0 f0 ff c1 fb std r30,-16(r1) f8 ff e1 fb std r31,-8(r1) 29 02 10 06 pla r2,36252592 # c0000000022aadc0 <__irq_regs>
...
85 dc ff 4b bl c000000000015ee0 <__do_irq> 00 00 21 e8 ld r1,0(r1) 28 00 2d e9 ld r9,40(r13) 30 00 21 38 addi r1,r1,48 2a 11 c9 7f stdx r30,r9,r2
Fix this by adding r2 to the clobber list for both call_do_irq() and call_do_softirq() when CONFIG_PPC_KERNEL_PCREL is enabled.
[0]: https://www.mail-archive.com/gcc-patches@gcc.gnu.org/msg313226.html
Detalles técnicos trazas, registros y código del informe original
BUG: Unable to handle kernel data access on write at 0xc000000404697638 Faulting instruction address: 0xc0000000000181ec Oops: Kernel access of bad area, sig: 11 [#1] NIP [c0000000000181ec] __do_IRQ+0x6c/0xc0
CVSS
NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.19%
- Percentil entre todas las CVEs puntuadas: 8
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
- https://git.kernel.org/stable/c/00be69070d91d2be978e752bb117a0a4db0e1281
- https://git.kernel.org/stable/c/602ee44415f3eaa7893f7fc488c7c1d4a0bdbd7a
- https://git.kernel.org/stable/c/7b0093b638c8f2b94b0778a69fd1ccad54299b29
- https://git.kernel.org/stable/c/90d953002cf0b233dd053a0e7cb67ab79cebd0e3
- https://git.kernel.org/stable/c/dcc442a49c0f540193910dacdca7506bcadc7ec5
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-93259",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "7e3a68be42e10f5fa5890e97afc0afd992355bc3",
"lessThan": "dcc442a49c0f540193910dacdca7506bcadc7ec5",
"versionType": "git"
},
{
"status": "affected",
"version": "7e3a68be42e10f5fa5890e97afc0afd992355bc3",
"lessThan": "602ee44415f3eaa7893f7fc488c7c1d4a0bdbd7a",
"versionType": "git"
},
{
"status": "affected",
"version": "7e3a68be42e10f5fa5890e97afc0afd992355bc3",
"lessThan": "90d953002cf0b233dd053a0e7cb67ab79cebd0e3",
"versionType": "git"
},
{
"status": "affected",
"version": "7e3a68be42e10f5fa5890e97afc0afd992355bc3",
"lessThan": "7b0093b638c8f2b94b0778a69fd1ccad54299b29",
"versionType": "git"
},
{
"status": "affected",
"version": "7e3a68be42e10f5fa5890e97afc0afd992355bc3",
"lessThan": "00be69070d91d2be978e752bb117a0a4db0e1281",
"versionType": "git"
}
],
"programFiles": [
"arch/powerpc/kernel/irq.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.4",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3-rc1",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"arch/powerpc/kernel/irq.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-09-24T16:17:22.530",
"references": [
{
"url": "https://git.kernel.org/stable/c/00be69070d91d2be978e752bb117a0a4db0e1281",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/602ee44415f3eaa7893f7fc488c7c1d4a0bdbd7a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/7b0093b638c8f2b94b0778a69fd1ccad54299b29",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/90d953002cf0b233dd053a0e7cb67ab79cebd0e3",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/dcc442a49c0f540193910dacdca7506bcadc7ec5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/irq: Fix missing r2 clobber in PCREL inline assembly\n\nIn CONFIG_PPC_KERNEL_PCREL mode, r2 is no longer reserved for the TOC\npointer and is available as a caller-saved register [0].\n\nBoth call_do_irq() and call_do_softirq() use inline assembly to call\nfunctions with stack switching, but fail to list r2 in their clobber\nlists. This causes the compiler to assume r2 is preserved across these\ncalls, leading to register corruption when the called functions\n(__do_irq and __do_softirq) clobber r2.\n\nAs a result of this kernel crash during interrupt handling is seen and\nthe kernel fails to boot:\n\nBUG: Unable to handle kernel data access on write at 0xc000000404697638\nFaulting instruction address: 0xc0000000000181ec\nOops: Kernel access of bad area, sig: 11 [#1]\nNIP [c0000000000181ec] __do_IRQ+0x6c/0xc0\n\nWith older GCC, the compiler would conservatively allocate\ncallee-saved registers (like r31) for values spanning function calls,\naccidentally avoiding the bug:\n\n<__do_IRQ>:\n00 00 00 60 \tnop\na6 02 08 7c \tmflr r0\nf8 ff e1 fb \tstd r31,-8(r1)\nf0 ff c1 fb \tstd r30,-16(r1)\n2d 03 10 06 \tpla r31,53297316\n\n...\n\n3d e8 ff 4b \tbl c0000000000165ac <__do_irq>\n00 00 21 e8 \tld r1,0(r1)\n28 00 4d e9 \tld r10,40(r13)\n40 00 21 38 \taddi r1,r1,64\n2a f9 aa 7f \tstdx r29,r10,r31\n\nWith newer GCC 14, the compiler uses r2 for such values, exposing the\nmissing clobber specification:\n\n<__do_IRQ>:\n00 00 00 60 nop\na6 02 08 7c mflr r0\nf0 ff c1 fb std r30,-16(r1)\nf8 ff e1 fb std r31,-8(r1)\n29 02 10 06 pla r2,36252592 # c0000000022aadc0 <__irq_regs>\n\n...\n\n85 dc ff 4b \tbl c000000000015ee0 <__do_irq>\n00 00 21 e8 \tld r1,0(r1)\n28 00 2d e9 \tld r9,40(r13)\n30 00 21 38 \taddi r1,r1,48\n2a 11 c9 7f \tstdx r30,r9,r2\n\nFix this by adding r2 to the clobber list for both call_do_irq() and\ncall_do_softirq() when CONFIG_PPC_KERNEL_PCREL is enabled.\n\n[0]: https://www.mail-archive.com/gcc-patches@gcc.gnu.org/msg313226.html"
}
],
"lastModified": "2026-09-24T16:17:22.530",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}