CVE-2026-64214: powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise()

Published Jul 24, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

powerpc/time: Remove redundant preemptdisable|enable() calls from archirqworkraise()

A kernel panic is observed when handling machine check exceptions from real mode.

BUG: Unable to handle kernel data access on read at 0xc00000006be21300 Oops: Kernel access of bad area, sig: 11 [#1] MSR: 8000000000001003 <SF,ME,RI,LE> CR: 88222248 XER: 00000005 CFAR: c00000000003ffc4 DAR: c00000006be21300 DSISR: 40000000 IRQMASK: 0 NIP [c000000000029e40] archirqworkraise+0x10/0x70 LR [c00000000003ffc8] machinecheckqueueevent+0xa8/0x150 Call Trace: [c0000000179d3c70] [c00000000003ff64] machinecheckqueueevent+0x44/0x150 [c0000000179d3d30] [c0000000000084e0] machinecheckearlycommon+0x1f0/0x2c0

The crash occurs because archirqworkraise() calls preemptdisable() from machine check exception (MCE) handlers running in real mode. In this context, accessing the preemptcount can fault, leading to the panic.

The preemptdisable()/preemptenable() pair in archirqworkraise() was originally added by commit 0fe1ac48bef0 ("powerpc/perfevent: Fix oops due to perfeventdopending call") to avoid races while raising irq work from exception context.

Later, commit 471ba0e686cb ("irqwork: Do not raise an IPI when queueing work on the local CPU") added preemption protection in irqworkqueue() path, while commit 20b876918c06 ("irqwork: Use per cpu atomics instead of regular atomics") added equivalent protection in irqworkqueueon() before reaching archirqworkraise():

irqworkqueue() / irqworkqueueon() -> preemptdisable() -> irqworkqueuelocal() -> irqworkraise() -> archirqworkraise()

As a result, callers other than mceirqworkraise() already execute with preemption disabled, making the additional preemptdisable()/preemptenable() pair in archirqworkraise() redundant.

The archirqworkraise() function executes in NMI context when called from MCE handler. Hence we will not be preempted or scheduled out since we are in NMI context with MSR[EE]=0. Therefore, it is safe to remove the preemptdisable()/preemptenable() calls from here.

Remove it to avoid accessing preemptcount from real mode context.

[Maddy: Fixed the commit title]

Affected Software

9 affected components
Linux Linux kernel
Linux Linux kernel>=5.18<6.1.175
Linux Linux kernel>=6.2<6.6.142
Linux Linux kernel>=6.7<6.12.92
Linux Linux kernel>=6.13<6.18.34
Linux Linux kernel>=6.19<7.0.11
Linux Linux kernel=7.1-rc1
Linux Linux kernel=7.1-rc2
Linux Linux kernel=7.1-rc3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Patch 471ba0e686cb
  2. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Patch 20b876918c06
  3. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Patch 0fe1ac48bef0

Event History

Jul 24, 2026
CVE Published
via MITRE·03:23 PM
Data Sourced
via MITRE·03:23 PM
Description
Data Sourced
via NVD·04:16 PM
RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2026-64214?

The severity of CVE-2026-64214 is rated as medium with a CVSS score of 5.5.

2

How do I fix CVE-2026-64214?

To fix CVE-2026-64214, update your Linux kernel to the latest version where the vulnerability has been patched.

3

What devices are affected by CVE-2026-64214?

CVE-2026-64214 affects systems running the Linux kernel that utilize powerpc architecture.

4

What type of vulnerability is CVE-2026-64214?

CVE-2026-64214 is categorized as a Null Pointer Dereference vulnerability.

5

What impact does CVE-2026-64214 have on systems?

CVE-2026-64214 can lead to a kernel panic during the handling of machine check exceptions.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203