Description
In the Linux kernel, the following vulnerability has been resolved:

powerpc/irq: Fix missing r2 clobber in PCREL inline assembly

In CONFIG_PPC_KERNEL_PCREL mode, r2 is no longer reserved for the TOC
pointer and is available as a caller-saved register [0].

Both call_do_irq() and call_do_softirq() use inline assembly to call
functions with stack switching, but fail to list r2 in their clobber
lists. This causes the compiler to assume r2 is preserved across these
calls, leading to register corruption when the called functions
(__do_irq and __do_softirq) clobber r2.

As a result of this kernel crash during interrupt handling is seen and
the kernel fails to boot:

BUG: Unable to handle kernel data access on write at 0xc000000404697638
Faulting instruction address: 0xc0000000000181ec
Oops: Kernel access of bad area, sig: 11 [#1]
NIP [c0000000000181ec] __do_IRQ+0x6c/0xc0

With older GCC, the compiler would conservatively allocate
callee-saved registers (like r31) for values spanning function calls,
accidentally avoiding the bug:

<__do_IRQ>:
00 00 00 60 nop
a6 02 08 7c mflr r0
f8 ff e1 fb std r31,-8(r1)
f0 ff c1 fb std r30,-16(r1)
2d 03 10 06 pla r31,53297316

...

3d e8 ff 4b bl c0000000000165ac <__do_irq>
00 00 21 e8 ld r1,0(r1)
28 00 4d e9 ld r10,40(r13)
40 00 21 38 addi r1,r1,64
2a f9 aa 7f stdx r29,r10,r31

With newer GCC 14, the compiler uses r2 for such values, exposing the
missing clobber specification:

<__do_IRQ>:
00 00 00 60 nop
a6 02 08 7c mflr r0
f0 ff c1 fb std r30,-16(r1)
f8 ff e1 fb std r31,-8(r1)
29 02 10 06 pla r2,36252592 # c0000000022aadc0 <__irq_regs>

...

85 dc ff 4b bl c000000000015ee0 <__do_irq>
00 00 21 e8 ld r1,0(r1)
28 00 2d e9 ld r9,40(r13)
30 00 21 38 addi r1,r1,48
2a 11 c9 7f stdx r30,r9,r2

Fix this by adding r2 to the clobber list for both call_do_irq() and
call_do_softirq() when CONFIG_PPC_KERNEL_PCREL is enabled.

[0]: https://www.mail-archive.com/gcc-patches@gcc.gnu.org/msg313226.html
Published: 2026-09-24
Score: n/a
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

The Linux kernel for PowerPC uses inline assembly in interrupt handling routines when CONFIG_PPC_KERNEL_PCREL is enabled. The clobber list for the caller-save register r2 was omitted in call_do_irq() and call_do_softirq(), causing the compiler to assume r2 is preserved. When the called functions __do_irq and __do_softirq modify r2, the kernel state becomes corrupted, leading to a crash during interrupt processing and preventing the system from booting or operating normally.

Affected Systems

All PowerPC platforms running the Linux kernel with CONFIG_PPC_KERNEL_PCREL enabled are impacted. This includes any builds that rely on PCREL mode for position‑relative addressing, regardless of the specific kernel release. Users of the default configuration on PowerPC hardware should verify whether the kernel image includes the missing clobber when the patch has not yet been applied.

Risk and Exploitability

The vulnerability is not catalogued in CISA KEV and no EPSS score is available, indicating the exploitation probability is not well quantified. The fault only occurs during interrupt handling, which typically requires privileged or physical access to generate or manipulate interrupts. The consequence is a kernel crash, providing a denial‑of‑service vector without direct confidentiality or integrity impact. Overall risk can be considered moderate pending confirmation that the affected configuration is in use.

Generated by OpenCVE AI on September 25, 2026 at 10:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the kernel patch that adds r2 to the clobber lists of call_do_irq() and call_do_softirq() for CONFIG_PPC_KERNEL_PCREL enabled kernels
  • Rebuild and install the patched Linux kernel on the target PowerPC system, ensuring the PCREL configuration remains active
  • If immediate application of the patch is not feasible, temporarily disable CONFIG_PPC_KERNEL_PCREL or build the kernel with GCC ≤13 as a mitigating workaround

Generated by OpenCVE AI on September 25, 2026 at 10:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4817-1 linux-6.12 security update
Debian DSA Debian DSA DSA-6528-1 linux security update
History

Fri, 25 Sep 2026 10:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-665

Thu, 24 Sep 2026 16:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: powerpc/irq: Fix missing r2 clobber in PCREL inline assembly In CONFIG_PPC_KERNEL_PCREL mode, r2 is no longer reserved for the TOC pointer and is available as a caller-saved register [0]. Both call_do_irq() and call_do_softirq() use inline assembly to call functions with stack switching, but fail to list r2 in their clobber lists. This causes the compiler to assume r2 is preserved across these calls, leading to register corruption when the called functions (__do_irq and __do_softirq) clobber r2. As a result of this kernel crash during interrupt handling is seen and the kernel fails to boot: BUG: Unable to handle kernel data access on write at 0xc000000404697638 Faulting instruction address: 0xc0000000000181ec Oops: Kernel access of bad area, sig: 11 [#1] NIP [c0000000000181ec] __do_IRQ+0x6c/0xc0 With older GCC, the compiler would conservatively allocate callee-saved registers (like r31) for values spanning function calls, accidentally avoiding the bug: <__do_IRQ>: 00 00 00 60 nop a6 02 08 7c mflr r0 f8 ff e1 fb std r31,-8(r1) f0 ff c1 fb std r30,-16(r1) 2d 03 10 06 pla r31,53297316 ... 3d e8 ff 4b bl c0000000000165ac <__do_irq> 00 00 21 e8 ld r1,0(r1) 28 00 4d e9 ld r10,40(r13) 40 00 21 38 addi r1,r1,64 2a f9 aa 7f stdx r29,r10,r31 With newer GCC 14, the compiler uses r2 for such values, exposing the missing clobber specification: <__do_IRQ>: 00 00 00 60 nop a6 02 08 7c mflr r0 f0 ff c1 fb std r30,-16(r1) f8 ff e1 fb std r31,-8(r1) 29 02 10 06 pla r2,36252592 # c0000000022aadc0 <__irq_regs> ... 85 dc ff 4b bl c000000000015ee0 <__do_irq> 00 00 21 e8 ld r1,0(r1) 28 00 2d e9 ld r9,40(r13) 30 00 21 38 addi r1,r1,48 2a 11 c9 7f stdx r30,r9,r2 Fix this by adding r2 to the clobber list for both call_do_irq() and call_do_softirq() when CONFIG_PPC_KERNEL_PCREL is enabled. [0]: https://www.mail-archive.com/gcc-patches@gcc.gnu.org/msg313226.html
Title powerpc/irq: Fix missing r2 clobber in PCREL inline assembly
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-24T15:51:45.772Z

Reserved: 2026-09-17T16:02:15.097Z

Link: CVE-2026-93259

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-24T16:17:22.530

Modified: 2026-09-24T16:17:22.530

Link: CVE-2026-93259

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-25T10:30:10Z

Weaknesses