UBUNTU-CVE-2026-90212: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: arm64/efi: Avoid voluntary preemption with efimm installed Gus reports a bad kernel memory access when using software PAN (CONFIGARM64SWTTBR0PAN=y) on a machine with support for EFI runtime services: Unable to handle kernel access to user memory outside uaccess routines at virtual address 00000000f322ff30 Mem abort info: ESR = 0x0000000096000004 FSC = 0x04: level 0 translation fault Internal error: Oops: 0000000096000004 [#1] SMP Workqueue: efirtswq eficallrts pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : eficallrts+0xd8/0x288 Call trace: eficallrts+0xd8/0x288 (P) processonework+0x178/0x4f8 workerthread+0x194/0x328 This is because the fpsimd context management code called from efifpsimdbegin() can preempt voluntarily, returning later to the EFI code with an incorrect value for TTBR0EL1 thanks to the deferred mm switching used by the software PAN implementation. Since EFI runtime services cannot preempt voluntarily and because the fpsimd switching code does not rely on the TTBR0EL1 mappings, simply reorder the fpsimd switch so that it occurs before we change the page-table.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In the arm64 EFI runtime-services path, reorder the FPSIMD context switch so it occurs before changing the page table, preventing voluntary preemption while efi_mm is installed.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The issue affects arm64 systems that support EFI runtime services and use software PAN with CONFIG_ARM64_SW_TTBR0_PAN enabled. The reported failure occurs while EFI runtime-service work is executing.
What conditions trigger the failure?
A voluntary preemption in the FPSIMD context-management path during an EFI runtime-services call can leave TTBR0_EL1 with an incorrect value under the software PAN implementation. This can lead to a kernel access to user memory outside uaccess routines and a kernel Oops.