CVE-2026-80626: powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del
In the Linux kernel, the following vulnerability has been resolved:
powerpc/perf: fix preempt count underflow in fslembpmudel
fslembpmudel() unconditionally calls putcpuvar(cpuhwevents) at the 'out:' label, but only calls the matching getcpuvar() after the 'i < 0' early-return check. When event->hw.idx is negative the function jumps to 'out:' without having taken getcpuvar(), and the trailing putcpuvar() then issues an unmatched preemptenable(), underflowing preemptcount.
On a CONFIGPREEMPT=y kernel preemptcount would underflow and eventually present as a 'scheduling while atomic' BUG.
Move putcpuvar() to pair with getcpuvar() so the percpu access is correctly bracketed and the 'out:' label only handles perfpmuenable.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Update/patch the Linux kernel to address the fix for preempt count underflow in fsl_emb_pmu_del (powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del), ensuring put_cpu_var() is correctly paired with get_cpu_var() so percpu access is properly bracketed.
Event History
Frequently Asked Questions
Which systems are most likely to be affected?
The issue is in the Linux kernel PowerPC performance-monitoring code, specifically fsl_emb_pmu_del. The described visible failure applies to kernels built with CONFIG_PREEMPT=y, where the preempt count can underflow and later trigger a "scheduling while atomic" BUG.
What condition triggers the underflow?
It occurs when fsl_emb_pmu_del handles an event whose event->hw.idx is negative. That path reaches cleanup without calling get_cpu_var(cpu_hw_events), but still calls put_cpu_var(cpu_hw_events), causing an unmatched preemption enable.
How can administrators identify a likely existing impact?
On a preemptible kernel, the issue may eventually surface as a "scheduling while atomic" BUG. The triggering path involves removal of a performance event with a negative hardware index.
What is the remediation?
Apply a kernel update containing the fix that moves put_cpu_var() to the scope paired with get_cpu_var(). This prevents the cleanup path for a negative event index from performing an unmatched put_cpu_var().