CVE-2026-93254: arm64: entry: Avoid unnecessary local_irq_disable() on kernel exit
In the Linux kernel, the following vulnerability has been resolved:
arm64: entry: Avoid unnecessary localirqdisable() on kernel exit
Currently, when exiting to kernel mode, we attempt involuntary preemption. The preemption logic expects IRQs to be disabled, which is why we call localirqdisable() before attempting preemption.
However, depending on the context, localirqdisable() may be unnecessary:
- el1irq(), the non-NMI EL1 IRQ path, already has IRQs disabled, so localirqdisable() is redundant.
- irqentryexittokernelmodepreempt() immediately returns when exiting from an NMI-like context, so calling localirqdisable() beforehand is unnecessary work.
Furthermore, it confuses the pNMI state tracking when we are in a context with interrupts disabled and the GICPRIOPSRISET bit is set in the PMR, leading to a warning when CONFIGARM64DEBUGPRIORITYMASKING=y:
WARNING: ./arch/arm64/include/asm/irqflags.h:63 at arm64exittokernelmode+0xb8/0xc0, CPU#40: retsnoop/31805 CPU: 40 UID: 0 PID: 31805 Comm: retsnoop Not tainted 7.2.0-rc6-next-20260805 #7 PREEMPTLAZY pstate: 234013c9 (nzCv DAIF +PAN -UAO +TCO +DIT +SSBS BTYPE=--) pc : arm64exittokernelmode (arch/arm64/kernel/entry-common.c:63) lr : el1abort (arch/arm64/kernel/entry-common.c:323) pmr: 000000f0 Call trace: arm64exittokernelmode (arch/arm64/kernel/entry-common.c:63) (P) el1abort (arch/arm64/kernel/entry-common.c:323) el1h64synchandler (arch/arm64/kernel/entry-common.c:449) el1h64sync (arch/arm64/kernel/entry.S:589) [...]
Split arm64exittokernelmode() into preempt, non-preempt, and dispatch parts so that we can avoid this extra work where it is not needed and avoid breaking the pNMI tracking logic.
Affected Software
Event History
Frequently Asked Questions
What evidence would indicate that a system is encountering this issue?
A warning at arch/arm64/include/asm/irqflags.h:63 during arm64_exit_to_kernel_mode is described. The warning is associated with CONFIG_ARM64_DEBUG_PRIORITY_MASKING=y and pNMI state tracking when interrupts are disabled while GIC_PRIO_PSR_I_SET is set in PMR.
Are specific fixed Linux kernel versions identified?
No fixed kernel version numbers are provided. The available references point to two stable kernel commit records.