CVE-2026-64214: powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise()
In the Linux kernel, the following vulnerability has been resolved:
powerpc/time: Remove redundant preemptdisable|enable() calls from archirqworkraise()
A kernel panic is observed when handling machine check exceptions from real mode.
BUG: Unable to handle kernel data access on read at 0xc00000006be21300 Oops: Kernel access of bad area, sig: 11 [#1] MSR: 8000000000001003 <SF,ME,RI,LE> CR: 88222248 XER: 00000005 CFAR: c00000000003ffc4 DAR: c00000006be21300 DSISR: 40000000 IRQMASK: 0 NIP [c000000000029e40] archirqworkraise+0x10/0x70 LR [c00000000003ffc8] machinecheckqueueevent+0xa8/0x150 Call Trace: [c0000000179d3c70] [c00000000003ff64] machinecheckqueueevent+0x44/0x150 [c0000000179d3d30] [c0000000000084e0] machinecheckearlycommon+0x1f0/0x2c0
The crash occurs because archirqworkraise() calls preemptdisable() from machine check exception (MCE) handlers running in real mode. In this context, accessing the preemptcount can fault, leading to the panic.
The preemptdisable()/preemptenable() pair in archirqworkraise() was originally added by commit 0fe1ac48bef0 ("powerpc/perfevent: Fix oops due to perfeventdopending call") to avoid races while raising irq work from exception context.
Later, commit 471ba0e686cb ("irqwork: Do not raise an IPI when queueing work on the local CPU") added preemption protection in irqworkqueue() path, while commit 20b876918c06 ("irqwork: Use per cpu atomics instead of regular atomics") added equivalent protection in irqworkqueueon() before reaching archirqworkraise():
irqworkqueue() / irqworkqueueon() -> preemptdisable() -> irqworkqueuelocal() -> irqworkraise() -> archirqworkraise()
As a result, callers other than mceirqworkraise() already execute with preemption disabled, making the additional preemptdisable()/preemptenable() pair in archirqworkraise() redundant.
The archirqworkraise() function executes in NMI context when called from MCE handler. Hence we will not be preempted or scheduled out since we are in NMI context with MSR[EE]=0. Therefore, it is safe to remove the preemptdisable()/preemptenable() calls from here.
Remove it to avoid accessing preemptcount from real mode context.
[Maddy: Fixed the commit title]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 471ba0e686cb - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 20b876918c06 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 0fe1ac48bef0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64214?
The severity of CVE-2026-64214 is rated as medium with a CVSS score of 5.5.
How do I fix CVE-2026-64214?
To fix CVE-2026-64214, update your Linux kernel to the latest version where the vulnerability has been patched.
What devices are affected by CVE-2026-64214?
CVE-2026-64214 affects systems running the Linux kernel that utilize powerpc architecture.
What type of vulnerability is CVE-2026-64214?
CVE-2026-64214 is categorized as a Null Pointer Dereference vulnerability.
What impact does CVE-2026-64214 have on systems?
CVE-2026-64214 can lead to a kernel panic during the handling of machine check exceptions.