Description
In the Linux kernel, the following vulnerability has been resolved:

arm64: entry: Avoid unnecessary local_irq_disable() on kernel exit

Currently, when exiting to kernel mode, we attempt involuntary
preemption. The preemption logic expects IRQs to be disabled, which is
why we call local_irq_disable() before attempting preemption.

However, depending on the context, local_irq_disable() may be
unnecessary:

- __el1_irq(), the non-NMI EL1 IRQ path, already has IRQs disabled, so
local_irq_disable() is redundant.

- irqentry_exit_to_kernel_mode_preempt() immediately returns when
exiting from an NMI-like context, so calling local_irq_disable()
beforehand is unnecessary work.

Furthermore, it confuses the pNMI state tracking when we are in a
context with interrupts disabled and the GIC_PRIO_PSR_I_SET bit is set
in the PMR, leading to a warning when
CONFIG_ARM64_DEBUG_PRIORITY_MASKING=y:

WARNING: ./arch/arm64/include/asm/irqflags.h:63 at arm64_exit_to_kernel_mode+0xb8/0xc0, CPU#40: retsnoop/31805
CPU: 40 UID: 0 PID: 31805 Comm: retsnoop Not tainted 7.2.0-rc6-next-20260805 #7 PREEMPTLAZY
pstate: 234013c9 (nzCv DAIF +PAN -UAO +TCO +DIT +SSBS BTYPE=--)
pc : arm64_exit_to_kernel_mode (arch/arm64/kernel/entry-common.c:63)
lr : el1_abort (arch/arm64/kernel/entry-common.c:323)
pmr: 000000f0
Call trace:
arm64_exit_to_kernel_mode (arch/arm64/kernel/entry-common.c:63) (P)
el1_abort (arch/arm64/kernel/entry-common.c:323)
el1h_64_sync_handler (arch/arm64/kernel/entry-common.c:449)
el1h_64_sync (arch/arm64/kernel/entry.S:589)
[...]

Split arm64_exit_to_kernel_mode() into preempt, non-preempt, and
dispatch parts so that we can avoid this extra work where it is not
needed and avoid breaking the pNMI tracking logic.
Published: 2026-09-24
Score: n/a
EPSS: < 1% Very Low
KEV: No
Impact: No direct security impact, only diagnostic noise and NMI state tracking confusion
Action: Patch
AI Analysis

Impact

The Linux kernel’s arm64_exit_to_kernel_mode path calls local_irq_disable() even when interrupts are already disabled. This unnecessary call does not allow an attacker to execute code or elevate privileges, but it generates warning messages when CONFIG_ARM64_DEBUG_PRIORITY_MASKING is enabled and can confuse developers tracking nMI debug state. The flaw is a logic error confined to ARM64 kernel context handling rather than an exploitable vulnerability.

Affected Systems

ARM64 Linux kernels built from the 7.2.0 series onward contain the bug until the patch that splits arm64_exit_to_kernel_mode into separate preempt, non‑preempt, and dispatch sections is applied. Distribution kernels that base their builds on the 7.2.0 series or later, as well as custom builds compiling the affected exit routines, are affected.

Risk and Exploitability

Because the vulnerability triggers only when a specific debug configuration is enabled and requires local access with kernel debugging privileges, it poses a very low exploitation probability. The EPSS score is not available and the issue is not listed in CISA KEV. No remote attack surface or privilege escalation path exists; the risk is diagnostic confusion.

Generated by OpenCVE AI on September 25, 2026 at 11:56 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the kernel to a version that includes the arm64_exit_to_kernel_mode fix (e.g., 7.2.0-rc6 or later stable releases).
  • Reboot the system so the patched kernel is loaded and the redundant local_irq_disable() call is removed.
  • If a patch cannot be applied immediately, temporarily disable CONFIG_ARM64_DEBUG_PRIORITY_MASKING to stop the warning generation, and monitor system logs for persistent diagnostic messages until a patch is applied.

Generated by OpenCVE AI on September 25, 2026 at 11:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 25 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-665

Thu, 24 Sep 2026 16:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: arm64: entry: Avoid unnecessary local_irq_disable() on kernel exit Currently, when exiting to kernel mode, we attempt involuntary preemption. The preemption logic expects IRQs to be disabled, which is why we call local_irq_disable() before attempting preemption. However, depending on the context, local_irq_disable() may be unnecessary: - __el1_irq(), the non-NMI EL1 IRQ path, already has IRQs disabled, so local_irq_disable() is redundant. - irqentry_exit_to_kernel_mode_preempt() immediately returns when exiting from an NMI-like context, so calling local_irq_disable() beforehand is unnecessary work. Furthermore, it confuses the pNMI state tracking when we are in a context with interrupts disabled and the GIC_PRIO_PSR_I_SET bit is set in the PMR, leading to a warning when CONFIG_ARM64_DEBUG_PRIORITY_MASKING=y: WARNING: ./arch/arm64/include/asm/irqflags.h:63 at arm64_exit_to_kernel_mode+0xb8/0xc0, CPU#40: retsnoop/31805 CPU: 40 UID: 0 PID: 31805 Comm: retsnoop Not tainted 7.2.0-rc6-next-20260805 #7 PREEMPTLAZY pstate: 234013c9 (nzCv DAIF +PAN -UAO +TCO +DIT +SSBS BTYPE=--) pc : arm64_exit_to_kernel_mode (arch/arm64/kernel/entry-common.c:63) lr : el1_abort (arch/arm64/kernel/entry-common.c:323) pmr: 000000f0 Call trace: arm64_exit_to_kernel_mode (arch/arm64/kernel/entry-common.c:63) (P) el1_abort (arch/arm64/kernel/entry-common.c:323) el1h_64_sync_handler (arch/arm64/kernel/entry-common.c:449) el1h_64_sync (arch/arm64/kernel/entry.S:589) [...] Split arm64_exit_to_kernel_mode() into preempt, non-preempt, and dispatch parts so that we can avoid this extra work where it is not needed and avoid breaking the pNMI tracking logic.
Title arm64: entry: Avoid unnecessary local_irq_disable() on kernel exit
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-24T15:51:40.955Z

Reserved: 2026-09-17T16:02:15.096Z

Link: CVE-2026-93254

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-24T16:17:21.807

Modified: 2026-09-24T16:17:21.807

Link: CVE-2026-93254

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-25T12:00:15Z

Weaknesses