CVE-2026-90212: arm64/efi: Avoid voluntary preemption with efi_mm installed

Published Sep 17, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

arm64/efi: Avoid voluntary preemption with efimm installed

Gus reports a bad kernel memory access when using software PAN (CONFIGARM64SWTTBR0PAN=y) on a machine with support for EFI runtime services:

Unable to handle kernel access to user memory outside uaccess routines at virtual address 00000000f322ff30 Mem abort info: ESR = 0x0000000096000004 FSC = 0x04: level 0 translation fault Internal error: Oops: 0000000096000004 [#1] SMP Workqueue: efirtswq eficallrts pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : eficallrts+0xd8/0x288 Call trace: eficallrts+0xd8/0x288 (P) processonework+0x178/0x4f8 workerthread+0x194/0x328

This is because the fpsimd context management code called from efifpsimdbegin() can preempt voluntarily, returning later to the EFI code with an incorrect value for TTBR0EL1 thanks to the deferred mm switching used by the software PAN implementation.

Since EFI runtime services cannot preempt voluntarily and because the fpsimd switching code does not rely on the TTBR0EL1 mappings, simply reorder the fpsimd switch so that it occurs before we change the page-table.

Affected Software

1 affected component
Linux Linux kernel

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Compensating control

    If possible, disable software PAN (CONFIG_ARM64_SW_TTBR0_PAN) on systems using EFI runtime services, since the bad kernel memory access occurs when using software PAN as described in the provided text.

Event History

Sep 17, 2026
CVE Published
via MITRE·04:07 PM
Data Sourced
via MITRE·04:07 PM
Description

Frequently Asked Questions

1

Which systems are affected by this issue?

The reported condition applies to arm64 systems using software PAN (CONFIG_ARM64_SW_TTBR0_PAN=y) with EFI runtime services available.

2

How can I recognize that this condition has occurred?

The report describes a kernel Oops during EFI runtime-service work, with a workqueue shown as efi_rts_wq running efi_call_rts. The fault may report a kernel access to user memory outside uaccess routines and a level 0 translation fault.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203