Description
In the Linux kernel, the following vulnerability has been resolved:

s390/percpu: Fix MVIY_PERCPU() with older binutils

Commit a737737cdb9c ("s390/percpu: Infrastructure for more efficient
this_cpu operations") introduced MVIY_PERCPU(), which stringifies
arguments that are already C string literals. This generates an
assembler macro invocation with whitespace-separated quoted arguments:

GEN_MVIY "459712" "%r3"

GNU as versions prior to binutils 2.39 drop the separating whitespace
between quoted macro arguments during input scrubbing. They
consequently parse the invocation as a single argument and emit
repeated warnings:

Warning: missing closing `"'

The .ifc in GEN_MVIY never matches and GNU as exits successfully
without emitting the mviy instruction. As a result, the interrupted
per-CPU sequence is not marked in lowcore and the exception return
path cannot repair the per-CPU address register after migration.

All MVIY_PERCPU() callers pass C string literals. Use them directly
and separate the assembler macro arguments with an explicit comma. The
resulting invocation is:

GEN_MVIY 459712, %r3

This form is unambiguous for GNU as and LLVM's integrated assembler.
This behavior was fixed in GNU as from binutils 2.39, but Linux
supports binutils 2.30.
Published: 2026-09-11
Score: 7 High
EPSS: < 1% Very Low
KEV: No
Impact: Kernel instability due to missing per‑CPU sequence marking
Action: Apply Patch
AI Analysis

Impact

The vulnerability arises from a kernel assembly macro that misparses when older versions of GNU assembler are used. The macro generates an invocation that several editions of the assembler scrub whitespace, collapsing two expected arguments into one and causing the macro to fail silently. As a result, the jump to the per‑CPU sequence is not emitted, and the kernel cannot properly reset the lowcore register during exception return after a CPU migration. The failure does not lead to direct code execution but can manifest as system instability or a potential denial‑of‑service when CPU migration occurs.

Affected Systems

All Linux kernels that contain the original MVIY_PERCPU() implementation and are built with binutils versions earlier than 2.39 are affected. This includes most distributions that ship the upstream kernel and compile it with older toolchains. Linux currently supports binutils 2.30; the issue was mitigated in the kernel by altering the macro to use comma‑separated arguments, which older assemblers can interpret correctly.

Risk and Exploitability

The CVSS score is 4.1, and the EPSS score is less than 1%. However, the attack surface remains local: an attacker must rebuild the kernel or supply a malformed build environment to trigger the defect. Because the failure only occurs during per‑CPU sequence handling, the exploitation probability is low, and the vulnerability is not listed in the CISA KEV catalog. The primary risk is the potential for kernel crashes or denial of service on systems that undergo CPU migration events.

Generated by OpenCVE AI on September 13, 2026 at 03:12 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the kernel patch contained in commit a737737cdb9c that replaces the whitespace‑separated macro arguments with comma‑separated arguments.
  • Upgrade the build toolchain to binutils 2.39 or later, which correctly parses the macro regardless of separator style.
  • After applying the patch or upgrading binutils, rebuild the kernel and verify that the assembly output contains the expected MVIY instruction and that per‑CPU sequence marking works as intended.

Generated by OpenCVE AI on September 13, 2026 at 03:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 13 Sep 2026 06:45:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 4.1, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}

cvssV3_1

{'score': 7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}


Sat, 12 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-88
References
Metrics threat_severity

None

cvssV3_1

{'score': 4.1, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate


Fri, 11 Sep 2026 23:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: s390/percpu: Fix MVIY_PERCPU() with older binutils Commit a737737cdb9c ("s390/percpu: Infrastructure for more efficient this_cpu operations") introduced MVIY_PERCPU(), which stringifies arguments that are already C string literals. This generates an assembler macro invocation with whitespace-separated quoted arguments: GEN_MVIY "459712" "%r3" GNU as versions prior to binutils 2.39 drop the separating whitespace between quoted macro arguments during input scrubbing. They consequently parse the invocation as a single argument and emit repeated warnings: Warning: missing closing `"' The .ifc in GEN_MVIY never matches and GNU as exits successfully without emitting the mviy instruction. As a result, the interrupted per-CPU sequence is not marked in lowcore and the exception return path cannot repair the per-CPU address register after migration. All MVIY_PERCPU() callers pass C string literals. Use them directly and separate the assembler macro arguments with an explicit comma. The resulting invocation is: GEN_MVIY 459712, %r3 This form is unambiguous for GNU as and LLVM's integrated assembler. This behavior was fixed in GNU as from binutils 2.39, but Linux supports binutils 2.30.
Title s390/percpu: Fix MVIY_PERCPU() with older binutils
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-13T06:29:33.766Z

Reserved: 2026-09-11T19:38:34.707Z

Link: CVE-2026-89459

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-11T20:19:26.780

Modified: 2026-09-13T07:17:09.733

Link: CVE-2026-89459

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:43:22Z

Links: CVE-2026-89459 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-13T03:15:13Z

Weaknesses
  • CWE-88

    Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')