CVE-2026-93260: powerpc/xive: propagate IPI init errors to prevent use-after-free
In the Linux kernel, the following vulnerability has been resolved:
powerpc/xive: propagate IPI init errors to prevent use-after-free
When xiveinitipis() fails (e.g. irqdomainallocirqs() fails), the error path frees the global xiveipis array. However, xivesmpprobe() previously ignored this failure and proceeded to call xivesetupcpuipi(), which dereferences the already-freed xiveipis pointer -- a use-after-free.
Now that xivesmpprobe() returns int (previous patch), propagate the error from xiveinitipis() and xivesetupcpuipi() through xivesmpprobe(). Check the return value in both pnvsmpprobe() and pSeriessmpprobe() so that IPI setup is aborted cleanly on failure, avoiding the use-after-free.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Propagate errors from xive_init_ipis() and xive_setup_cpu_ipi() through xive_smp_probe() and pSeries_smp_probe(), checking the return values and aborting IPI setup cleanly to prevent use-after-free of the freed xive_ipis array.
Event History
Frequently Asked Questions
Which systems are affected by this issue?
The affected code is in the Linux kernel powerpc XIVE interrupt-controller path. The failure handling explicitly involves both pnv_smp_probe() and pSeries_smp_probe(), so systems using those XIVE SMP probe paths are relevant.
What condition is required to trigger the use-after-free?
IPI initialization must fail, such as when irq_domain_alloc_irqs() fails. Previously, the probe path could ignore that failure and continue into CPU IPI setup after the global xive_ipis array had been freed.
What happens after IPI initialization fails in the corrected code?
The initialization error is propagated through xive_smp_probe() and checked by the pnv and pSeries SMP probe paths. IPI setup is then aborted rather than dereferencing the freed xive_ipis pointer.