CVE-2026-93254: arm64: entry: Avoid unnecessary local_irq_disable() on kernel exit

Published Sep 24, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

arm64: entry: Avoid unnecessary localirqdisable() on kernel exit

Currently, when exiting to kernel mode, we attempt involuntary preemption. The preemption logic expects IRQs to be disabled, which is why we call localirqdisable() before attempting preemption.

However, depending on the context, localirqdisable() may be unnecessary:

- el1irq(), the non-NMI EL1 IRQ path, already has IRQs disabled, so localirqdisable() is redundant.

- irqentryexittokernelmodepreempt() immediately returns when exiting from an NMI-like context, so calling localirqdisable() beforehand is unnecessary work.

Furthermore, it confuses the pNMI state tracking when we are in a context with interrupts disabled and the GICPRIOPSRISET bit is set in the PMR, leading to a warning when CONFIGARM64DEBUGPRIORITYMASKING=y:

WARNING: ./arch/arm64/include/asm/irqflags.h:63 at arm64exittokernelmode+0xb8/0xc0, CPU#40: retsnoop/31805 CPU: 40 UID: 0 PID: 31805 Comm: retsnoop Not tainted 7.2.0-rc6-next-20260805 #7 PREEMPTLAZY pstate: 234013c9 (nzCv DAIF +PAN -UAO +TCO +DIT +SSBS BTYPE=--) pc : arm64exittokernelmode (arch/arm64/kernel/entry-common.c:63) lr : el1abort (arch/arm64/kernel/entry-common.c:323) pmr: 000000f0 Call trace: arm64exittokernelmode (arch/arm64/kernel/entry-common.c:63) (P) el1abort (arch/arm64/kernel/entry-common.c:323) el1h64synchandler (arch/arm64/kernel/entry-common.c:449) el1h64sync (arch/arm64/kernel/entry.S:589) [...]

Split arm64exittokernelmode() into preempt, non-preempt, and dispatch parts so that we can avoid this extra work where it is not needed and avoid breaking the pNMI tracking logic.

Affected Software

1 affected component
Linux Linux kernel

Event History

Sep 24, 2026
CVE Published
via MITRE·03:51 PM
Data Sourced
via MITRE·03:51 PM
Description
Data Sourced
via NVD·04:17 PM
Description

Frequently Asked Questions

1

What evidence would indicate that a system is encountering this issue?

A warning at arch/arm64/include/asm/irqflags.h:63 during arm64_exit_to_kernel_mode is described. The warning is associated with CONFIG_ARM64_DEBUG_PRIORITY_MASKING=y and pNMI state tracking when interrupts are disabled while GIC_PRIO_PSR_I_SET is set in PMR.

2

Are specific fixed Linux kernel versions identified?

No fixed kernel version numbers are provided. The available references point to two stable kernel commit records.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203