CVE-2026-90304: ARM: 9484/1: enable interrupts when unhandled user faults are triggered
In the Linux kernel, the following vulnerability has been resolved:
ARM: 9484/1: enable interrupts when unhandled user faults are triggered
PREEMPTRT requires interrupts to be enabled when sending signals.
When doDataAbort()/doPrefetchAbort() triggers unhandled user faults, that is inf->fn() return a non-zero value, and the interrupts are not enabled within the hook function, forcesigfault() will be called with interrupts disabled.
This can be triggered by user programs executing the bkpt instruction, with kernel config CONFIGPERFEVENTS=n.
Enable interrupts in doDataAbort()/doPrefetchAbort() when unhandled user faults are triggered to fix the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the ARM fault handlers to enable interrupts in do_DataAbort()/do_PrefetchAbort() when handling unhandled user faults so that PREEMPT_RT can send signals correctly (fix for the case where force_sig_fault() is invoked via inf->fn() non-zero while interrupts would otherwise remain disabled, particularly when CONFIG_PERF_EVENTS=n).
Linux kernel (ARM) PREEMPT_RT Interrupt handling for unhandled user faults in do_DataAbort()/do_PrefetchAbort() = enabled
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The issue affects ARM Linux kernel systems using PREEMPT_RT where unhandled user faults reach force_sig_fault() with interrupts disabled. The described trigger specifically requires CONFIG_PERF_EVENTS=n.
What is required to trigger the vulnerable path?
A user program can trigger it by executing the bkpt instruction. The fault must be unhandled, meaning the relevant fault hook returns a non-zero value without enabling interrupts.
Are systems with performance events enabled affected by the described trigger?
The provided trigger is specifically stated for kernels built with CONFIG_PERF_EVENTS=n. The data does not establish that the same bkpt-based path is reachable when performance events are enabled.