Description
In the Linux kernel, the following vulnerability has been resolved:

powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del

fsl_emb_pmu_del() unconditionally calls put_cpu_var(cpu_hw_events) at
the 'out:' label, but only calls the matching get_cpu_var() after the
'i < 0' early-return check. When event->hw.idx is negative the
function jumps to 'out:' without having taken get_cpu_var(), and the
trailing put_cpu_var() then issues an unmatched preempt_enable(),
underflowing preempt_count.

On a CONFIG_PREEMPT=y kernel preempt_count would underflow and
eventually present as a 'scheduling while atomic' BUG.

Move put_cpu_var() to pair with get_cpu_var() so the percpu access is
correctly bracketed and the 'out:' label only handles perf_pmu_enable.
Published: 2026-08-28
Score: n/a
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The fault resides in the handling of the PowerPC performance monitoring unit within the Linux kernel. A negative event index causes the cleanup path to skip the matching get_cpu_var() before executing put_cpu_var(), which in turn generates a preempt_enable() call without a preceding preempt_disable(). On CONFIG_PREEMPT=y kernels this mismatch underflows the preempt_count counter, eventually triggering the "scheduling while atomic" BUG. The resulting instability can lead to corrupted scheduling state, erratic interrupt handling or system crashes, effectively creating a denial‑of‑service vector for local users with sufficient privileges to load or trigger the faulty kernel module.

Affected Systems

Affected systems are Linux kernel builds running on PowerPC architectures that include the fsl_emb_pmu performance monitoring unit implementation. Any kernel that incorporates the legacy code path in powerpc/perf before the commit that applies the fix is vulnerable; newer releases that backport the change are not affected.

Risk and Exploitability

The CVSS score is not listed, but the severity is high because the issue directly corrupts kernel scheduling. The EPSS score is not available, so the probability of exploitation remains unknown. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting no confirmed public exploits yet. The likely attack vector is local privilege escalation or kernel module loading by a user with root or equivalent rights.

Generated by OpenCVE AI on August 28, 2026 at 11:14 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the kernel patch that pairs get_cpu_var() and put_cpu_var() calls, then reboot to load the updated kernel
  • If the patch is not available for your distribution, temporarily disable the fsl_emb_pmu performance monitoring module or remove CONFIG_PMU_FSL_EMB from the kernel configuration until an official update can be applied
  • Enable kernel hardening features such as CONFIG_KCSAN (Kernel Concurrency Sanitizer) during development and testing to surface anomalous preemption state changes caused by underflow

Generated by OpenCVE AI on August 28, 2026 at 11:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 28 Aug 2026 11:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-665
CWE-680

Fri, 28 Aug 2026 07:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del fsl_emb_pmu_del() unconditionally calls put_cpu_var(cpu_hw_events) at the 'out:' label, but only calls the matching get_cpu_var() after the 'i < 0' early-return check. When event->hw.idx is negative the function jumps to 'out:' without having taken get_cpu_var(), and the trailing put_cpu_var() then issues an unmatched preempt_enable(), underflowing preempt_count. On a CONFIG_PREEMPT=y kernel preempt_count would underflow and eventually present as a 'scheduling while atomic' BUG. Move put_cpu_var() to pair with get_cpu_var() so the percpu access is correctly bracketed and the 'out:' label only handles perf_pmu_enable.
Title powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-28T06:48:44.182Z

Reserved: 2026-08-26T14:34:25.775Z

Link: CVE-2026-80626

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-28T08:16:46.740

Modified: 2026-08-28T08:16:46.740

Link: CVE-2026-80626

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T11:30:06Z

Weaknesses
  • CWE-665

    Improper Initialization

  • CWE-680

    Integer Overflow to Buffer Overflow