CVE-2026-64214 - Vulnerability Details

- powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise()

Description

In the Linux kernel, the following vulnerability has been resolved:

powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise()

A kernel panic is observed when handling machine check exceptions from
real mode.

BUG: Unable to handle kernel data access on read at 0xc00000006be21300
Oops: Kernel access of bad area, sig: 11 [#1]
MSR: 8000000000001003 <SF,ME,RI,LE> CR: 88222248 XER: 00000005
CFAR: c00000000003ffc4 DAR: c00000006be21300 DSISR: 40000000 IRQMASK: 0
NIP [c000000000029e40] arch_irq_work_raise+0x10/0x70
LR [c00000000003ffc8] machine_check_queue_event+0xa8/0x150
Call Trace:
[c0000000179d3c70] [c00000000003ff64] machine_check_queue_event+0x44/0x150
[c0000000179d3d30] [c0000000000084e0] machine_check_early_common+0x1f0/0x2c0

The crash occurs because arch_irq_work_raise() calls preempt_disable()
from machine check exception (MCE) handlers running in real mode. In
this context, accessing the preempt_count can fault, leading to the panic.

The preempt_disable()/preempt_enable() pair in arch_irq_work_raise()
was originally added by commit 0fe1ac48bef0 ("powerpc/perf_event: Fix
oops due to perf_event_do_pending call") to avoid races while raising
irq work from exception context.

Later, commit 471ba0e686cb ("irq_work: Do not raise an IPI when
queueing work on the local CPU") added preemption protection in
irq_work_queue() path, while commit 20b876918c06 ("irq_work: Use per
cpu atomics instead of regular atomics") added equivalent
protection in irq_work_queue_on() before reaching arch_irq_work_raise():

irq_work_queue() / irq_work_queue_on()
-> preempt_disable()
-> __irq_work_queue_local()
-> irq_work_raise()
-> arch_irq_work_raise()

As a result, callers other than mce_irq_work_raise() already execute
with preemption disabled, making the additional
preempt_disable()/preempt_enable() pair in arch_irq_work_raise()
redundant.

The arch_irq_work_raise() function executes in NMI context when called
from MCE handler. Hence we will not be preempted or scheduled out since
we are in NMI context with MSR[EE]=0. Therefore, it is safe to remove
the preempt_disable()/preempt_enable() calls from here.

Remove it to avoid accessing preempt_count from real mode context.

[Maddy: Fixed the commit title]

Published: 2026-07-24

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The flaw resides in the Linux PowerPC kernel when arch_irq_work_raise() redundantly calls preempt_disable() and preempt_enable() during machine‑check exception handling in real‑mode. Accessing the preemption counter from an NMI context causes a fault that results in a kernel panic. This impacts system availability. The defect is triggered only when a machine‑check exception occurs, which is typically induced by a hardware fault or an error in low‑level firmware and is not readily controllable by an external attacker.

Affected Systems

All Linux kernels that compile for the PowerPC architecture contain the vulnerable arch/powerpc/time module. Any build that has not applied the change that removes the preempt_disable()/enable() pair in arch_irq_work_raise() remains affected, regardless of its major release version. Systems using older kernels or custom patches that omit the commit can experience the crash when a machine‑check exception is raised.

Risk and Exploitability

The EPSS score is reported as < 1 % and the vulnerability is not listed in the CISA KEV catalog, indicating a very low likelihood of exploitation in the wild. An attacker would need to trigger a machine‑check exception while the system is in real‑mode, which is generally only achievable through a hardware fault or a highly privileged local condition. The impact of successful exploitation would be a complete system crash, but given the constraints on triggering the fault, the overall risk is considered moderate to low.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`cc15ff3275694fedc33cd3d53212a43eec7aa0bc`	affected	< 51860e423592893cd7bfa7287d99a3aff4dc3a9d
`cc15ff3275694fedc33cd3d53212a43eec7aa0bc`	affected	< a09d07ac45e283c9861a9ceea06f56d0ba851d22
`cc15ff3275694fedc33cd3d53212a43eec7aa0bc`	affected	< 72d8d1c36452a4d3ee134b1da48de7518c1329f9
`cc15ff3275694fedc33cd3d53212a43eec7aa0bc`	affected	< 6dcd072a5ae3aed336e4a67a7d4cc5205b240065
`cc15ff3275694fedc33cd3d53212a43eec7aa0bc`	affected	< 8079acc5ee5235a627e4586d4f42082a9000ea64
`cc15ff3275694fedc33cd3d53212a43eec7aa0bc`	affected	< 31467b23823ffec1f6fff407f8e3ca9af8b7491a

Linux

affected

Version	Status	Constraints
`5.18`	affected	—
`0`	unaffected	< 5.18
`6.1.175`	unaffected	≤ 6.1.*
`6.6.142`	unaffected	≤ 6.6.*
`6.12.92`	unaffected	≤ 6.12.*
`6.18.34`	unaffected	≤ 6.18.*
`7.0.11`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc2::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc3::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[cc15ff3275694fedc33cd3d53212a43eec7aa0bc,51860e423592893cd7bfa7287d99a3aff4dc3a9d)`	affected	code_commit	—
`[cc15ff3275694fedc33cd3d53212a43eec7aa0bc,a09d07ac45e283c9861a9ceea06f56d0ba851d22)`	affected	code_commit	—
`[cc15ff3275694fedc33cd3d53212a43eec7aa0bc,72d8d1c36452a4d3ee134b1da48de7518c1329f9)`	affected	code_commit	—
`[cc15ff3275694fedc33cd3d53212a43eec7aa0bc,6dcd072a5ae3aed336e4a67a7d4cc5205b240065)`	affected	code_commit	—
`[cc15ff3275694fedc33cd3d53212a43eec7aa0bc,8079acc5ee5235a627e4586d4f42082a9000ea64)`	affected	code_commit	—
`[cc15ff3275694fedc33cd3d53212a43eec7aa0bc,31467b23823ffec1f6fff407f8e3ca9af8b7491a)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.18`	affected	generic	—
`[0,5.18)`	unaffected	semver	—
`[6.1.175,6.2.0)`	unaffected	semver	—
`[6.6.142,6.7.0)`	unaffected	semver	—
`[6.12.92,6.13.0)`	unaffected	semver	—
`[6.18.34,6.19.0)`	unaffected	semver	—
`[7.0.11,7.1.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the latest Linux kernel release that removes the redundant preempt_disable/enable calls in arch_irq_work_raise().
After upgrading, reboot the affected systems to clear any stale preemption state.
Continuously monitor kernel logs (e.g., dmesg) for any machine‑check exception or Oops entries to ensure the patch is effective.

Generated by OpenCVE AI on August 13, 2026 at 11:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8618-1	Linux kernel vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00123.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/31467b23823ffec1f6fff407f8e3ca9af8b7491a
https://git.kernel.org/stable/c/51860e423592893cd7bfa7287d99a3aff4dc3a9d
https://git.kernel.org/stable/c/6dcd072a5ae3aed336e4a67a7d4cc5205b240065
https://git.kernel.org/stable/c/72d8d1c36452a4d3ee134b1da48de7518c1329f9
https://git.kernel.org/stable/c/8079acc5ee5235a627e4586d4f42082a9000ea64
https://git.kernel.org/stable/c/a09d07ac45e283c9861a9ceea06f56d0ba851d22
https://lore.kernel.org/linux-cve-announce/2026072415-CVE-2026-64214-590c@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64214
https://www.cve.org/CVERecord?id=CVE-2026-64214

History

Tue, 11 Aug 2026 17:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476
CPEs		cpe:2.3:o:linux:linux_kernel:7.1:rc1:::::: cpe:2.3:o:linux:linux_kernel:7.1:rc2:::::: cpe:2.3:o:linux:linux_kernel:7.1:rc3::::::

Mon, 03 Aug 2026 20:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-125

Tue, 28 Jul 2026 16:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026072415-CVE-2026-64214-590c@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64214 https://www.cve.org/CVERecord?id=CVE-2026-64214
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Sun, 26 Jul 2026 03:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125

Fri, 24 Jul 2026 18:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: powerpc/time: Remove redundant preempt_disable\|enable() calls from arch_irq_work_raise() A kernel panic is observed when handling machine check exceptions from real mode. BUG: Unable to handle kernel data access on read at 0xc00000006be21300 Oops: Kernel access of bad area, sig: 11 [#1] MSR: 8000000000001003 <SF,ME,RI,LE> CR: 88222248 XER: 00000005 CFAR: c00000000003ffc4 DAR: c00000006be21300 DSISR: 40000000 IRQMASK: 0 NIP [c000000000029e40] arch_irq_work_raise+0x10/0x70 LR [c00000000003ffc8] machine_check_queue_event+0xa8/0x150 Call Trace: [c0000000179d3c70] [c00000000003ff64] machine_check_queue_event+0x44/0x150 [c0000000179d3d30] [c0000000000084e0] machine_check_early_common+0x1f0/0x2c0 The crash occurs because arch_irq_work_raise() calls preempt_disable() from machine check exception (MCE) handlers running in real mode. In this context, accessing the preempt_count can fault, leading to the panic. The preempt_disable()/preempt_enable() pair in arch_irq_work_raise() was originally added by commit 0fe1ac48bef0 ("powerpc/perf_event: Fix oops due to perf_event_do_pending call") to avoid races while raising irq work from exception context. Later, commit 471ba0e686cb ("irq_work: Do not raise an IPI when queueing work on the local CPU") added preemption protection in irq_work_queue() path, while commit 20b876918c06 ("irq_work: Use per cpu atomics instead of regular atomics") added equivalent protection in irq_work_queue_on() before reaching arch_irq_work_raise(): irq_work_queue() / irq_work_queue_on() -> preempt_disable() -> __irq_work_queue_local() -> irq_work_raise() -> arch_irq_work_raise() As a result, callers other than mce_irq_work_raise() already execute with preemption disabled, making the additional preempt_disable()/preempt_enable() pair in arch_irq_work_raise() redundant. The arch_irq_work_raise() function executes in NMI context when called from MCE handler. Hence we will not be preempted or scheduled out since we are in NMI context with MSR[EE]=0. Therefore, it is safe to remove the preempt_disable()/preempt_enable() calls from here. Remove it to avoid accessing preempt_count from real mode context. [Maddy: Fixed the commit title]
Title		powerpc/time: Remove redundant preempt_disable\|enable() calls from arch_irq_work_raise()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/31467b23823ffec1f6fff407f8e3ca9af8b7491a https://git.kernel.org/stable/c/51860e423592893cd7bfa7287d99a3aff4dc3a9d https://git.kernel.org/stable/c/6dcd072a5ae3aed336e4a67a7d4cc5205b240065 https://git.kernel.org/stable/c/72d8d1c36452a4d3ee134b1da48de7518c1329f9 https://git.kernel.org/stable/c/8079acc5ee5235a627e4586d4f42082a9000ea64 https://git.kernel.org/stable/c/a09d07ac45e283c9861a9ceea06f56d0ba851d22

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-24T15:23:03.529Z

Updated: 2026-07-24T15:23:03.529Z

Reserved: 2026-07-19T15:36:31.770Z

Link: CVE-2026-64214

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-07-24T16:16:49.053

Modified: 2026-08-11T17:19:15.970

Link: CVE-2026-64214

Redhat

Severity : Low

Publid Date: 2026-07-24T00:00:00Z

Links: CVE-2026-64214 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-13T11:15:05Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object