CVE-2026-98888 - Vulnerability Details

- arm64: kprobes: Allow reentering kprobes while single-stepping

Description

In the Linux kernel, the following vulnerability has been resolved:

arm64: kprobes: Allow reentering kprobes while single-stepping

A kprobe can be hit while another kprobe is in KPROBE_HIT_SS state. This
can happen when tracing or perf code runs from the debug exception path
while the first kprobe is preparing or executing its out-of-line
single-step instruction.

Currently arm64 treats a kprobe hit in KPROBE_HIT_SS as unrecoverable,
the same as a hit in KPROBE_REENTER. This is too strict. A hit in
KPROBE_HIT_SS is still a one-level reentry and can be handled by saving
the current kprobe state and setting up single-step for the new probe,
just like reentry from KPROBE_HIT_ACTIVE or KPROBE_HIT_SSDONE.

The truly unrecoverable case is hitting another kprobe while already in
KPROBE_REENTER, because the reentry save area has already been consumed.

Move KPROBE_HIT_SS to the recoverable reentry cases and leave
KPROBE_REENTER as the unrecoverable nested reentry case.

This change also requires saving saved_irqflag in struct prev_kprobe.
When a nested kprobe calls kprobes_save_local_irqflag(), it overwrites
kcb->saved_irqflag with the currently masked DAIF value, losing the
outer kprobe's original DAIF state. Without this fix, when the outer
kprobe's single-step finishes, kprobes_restore_local_irqflag() applies
the wrong DAIF mask and leaves interrupts permanently disabled.

Extend struct prev_kprobe with a saved_irqflag field and save/restore it
alongside kp and status. This ensures the outer kprobe's original
interrupt state is preserved across reentry.

This mirrors the x86 fix in commit 6a5022a56ac3
("kprobes/x86: Allow to handle reentered kprobe on single-stepping").

Published: 2026-10-23

Score: n/a

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability is a flaw in the Linux kernel arm64 kprobe implementation that incorrectly treats a single‑step re‑entry of a kprobe as unrecoverable. When a second kprobe is hit during single‑stepping, the current kprobe state is overwritten, and the saved interrupt flag is lost, causing interrupts to remain disabled after the outer kprobe finishes. This state corruption can bring the system to a hung or crash condition, effectively denying service for any user or process that relies on the kernel’s ability to handle interrupts during debugging or performance monitoring.

Affected Systems

All Linux kernel arm64 builds prior to the commit that adds support for recoverable re‑entry are affected. The issue is present in the generic Linux vendor product; version information is not specified, so users should verify that their kernel includes the fix or has been updated to a release that contains the patch.

Risk and Exploitability

The CVSS score and EPSS metrics are not available, and the vulnerability is not listed in CISA’s KEV catalog, indicating no confirmed public exploitation. However, the bug requires the ability to trigger a kprobe single‑step re‑entry, which typically implies local privileges or a debugging environment. When triggered, the flaw can cause a denial of service by permanently disabling interrupts, leading to a system freeze or crash. Updating the kernel to a version that incorporates the recent commit is the definitive remediation.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< bb0fe9121aa0824211aafa33c7d0151fd25ddb75
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< f96a0606de6bcc8d937b80e6470fd7a174c17e26
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 1f342b3e44c3035a837b53b217d816f7511c0d0a
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< c8e84e292ed4cfc199824146da71bb4397b02a1f
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 68774caca799e9695db56d426c69acebd041c2ed
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< a21bf9cb893126e8d9730995708d0be5eb167652
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 23f851ac0078a908bf3422d6467ebc1db5828c46
`0`	affected	< 5.10.271
`0`	affected	< 5.15.222
`0`	affected	< 6.1.189
`0`	affected	< 6.6.158
`0`	affected	< 6.12.111
`0`	affected	< 6.18.53

Linux

affected

Version	Status	Constraints
`5.10.271`	unaffected	≤ 5.10.*
`5.15.222`	unaffected	≤ 5.15.*
`6.1.189`	unaffected	≤ 6.1.*
`6.6.158`	unaffected	≤ 6.6.*
`6.12.111`	unaffected	≤ 6.12.*
`6.18.53`	unaffected	≤ 6.18.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

100%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,bb0fe9121aa0824211aafa33c7d0151fd25ddb75)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,f96a0606de6bcc8d937b80e6470fd7a174c17e26)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,1f342b3e44c3035a837b53b217d816f7511c0d0a)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,23f851ac0078a908bf3422d6467ebc1db5828c46)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,68774caca799e9695db56d426c69acebd041c2ed)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,a21bf9cb893126e8d9730995708d0be5eb167652)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,23f851ac0078a908bf3422d6467ebc1db5828c46)`	affected	code_commit	—
`[0,5.10.271)`	affected	semver	—
`[0,5.15.222)`	affected	semver	—
`[0,6.1.189)`	affected	semver	—
`[0,6.6.158)`	affected	semver	—
`[0,6.12.111)`	affected	semver	—
`[0,6.18.53)`	affected	semver	—

Linux

100%

Version	Status	Scheme	Platform
`[5.10.271,5.11.0)`	unaffected	semver	—
`[5.15.222,5.16.0)`	unaffected	semver	—
`[6.1.189,6.2.0)`	unaffected	semver	—
`[6.6.158,6.7.0)`	unaffected	semver	—
`[6.12.111,6.13.0)`	unaffected	semver	—
`[6.18.53,6.19.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,bb0fe9121aa0824211aafa33c7d0151fd25ddb75)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,f96a0606de6bcc8d937b80e6470fd7a174c17e26)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,1f342b3e44c3035a837b53b217d816f7511c0d0a)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,23f851ac0078a908bf3422d6467ebc1db5828c46)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,68774caca799e9695db56d426c69acebd041c2ed)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,a21bf9cb893126e8d9730995708d0be5eb167652)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,23f851ac0078a908bf3422d6467ebc1db5828c46)`	affected	code_commit	—
`[0,5.10.271)`	affected	semver	—
`[0,5.15.222)`	affected	semver	—
`[0,6.1.189)`	affected	semver	—
`[0,6.6.158)`	affected	semver	—
`[0,6.12.111)`	affected	semver	—
`[0,6.18.53)`	affected	semver	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`[5.10.271,5.11.0)`	unaffected	semver	—
`[5.15.222,5.16.0)`	unaffected	semver	—
`[6.1.189,6.2.0)`	unaffected	semver	—
`[6.6.158,6.7.0)`	unaffected	semver	—
`[6.12.111,6.13.0)`	unaffected	semver	—
`[6.18.53,6.19.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the kernel to a version that includes the kprobe reentry fix (e.g., merge the commit or use a kernel newer than the patch).
If an immediate patch is not available, avoid using kprobes, perf, or single‑stepping on arm64 systems until the fix is applied.
After applying the update or disabling the features, monitor kernel logs for any instability and verify that interrupts resume normal operation.

Generated by OpenCVE AI on October 23, 2026 at 14:13 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1f342b3e44c3035a837b53b217d816f7511c0d0a
https://git.kernel.org/stable/c/23f851ac0078a908bf3422d6467ebc1db5828c46
https://git.kernel.org/stable/c/68774caca799e9695db56d426c69acebd041c2ed
https://git.kernel.org/stable/c/a21bf9cb893126e8d9730995708d0be5eb167652
https://git.kernel.org/stable/c/bb0fe9121aa0824211aafa33c7d0151fd25ddb75
https://git.kernel.org/stable/c/c8e84e292ed4cfc199824146da71bb4397b02a1f
https://git.kernel.org/stable/c/f96a0606de6bcc8d937b80e6470fd7a174c17e26

History

Fri, 23 Oct 2026 14:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Linux linux
Weaknesses		CWE-665
Vendors & Products		Linux linux

Fri, 23 Oct 2026 12:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: arm64: kprobes: Allow reentering kprobes while single-stepping A kprobe can be hit while another kprobe is in KPROBE_HIT_SS state. This can happen when tracing or perf code runs from the debug exception path while the first kprobe is preparing or executing its out-of-line single-step instruction. Currently arm64 treats a kprobe hit in KPROBE_HIT_SS as unrecoverable, the same as a hit in KPROBE_REENTER. This is too strict. A hit in KPROBE_HIT_SS is still a one-level reentry and can be handled by saving the current kprobe state and setting up single-step for the new probe, just like reentry from KPROBE_HIT_ACTIVE or KPROBE_HIT_SSDONE. The truly unrecoverable case is hitting another kprobe while already in KPROBE_REENTER, because the reentry save area has already been consumed. Move KPROBE_HIT_SS to the recoverable reentry cases and leave KPROBE_REENTER as the unrecoverable nested reentry case. This change also requires saving saved_irqflag in struct prev_kprobe. When a nested kprobe calls kprobes_save_local_irqflag(), it overwrites kcb->saved_irqflag with the currently masked DAIF value, losing the outer kprobe's original DAIF state. Without this fix, when the outer kprobe's single-step finishes, kprobes_restore_local_irqflag() applies the wrong DAIF mask and leaves interrupts permanently disabled. Extend struct prev_kprobe with a saved_irqflag field and save/restore it alongside kp and status. This ensures the outer kprobe's original interrupt state is preserved across reentry. This mirrors the x86 fix in commit 6a5022a56ac3 ("kprobes/x86: Allow to handle reentered kprobe on single-stepping").
Title		arm64: kprobes: Allow reentering kprobes while single-stepping
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1f342b3e44c3035a837b53b217d816f7511c0d0a https://git.kernel.org/stable/c/23f851ac0078a908bf3422d6467ebc1db5828c46 https://git.kernel.org/stable/c/68774caca799e9695db56d426c69acebd041c2ed https://git.kernel.org/stable/c/a21bf9cb893126e8d9730995708d0be5eb167652 https://git.kernel.org/stable/c/bb0fe9121aa0824211aafa33c7d0151fd25ddb75 https://git.kernel.org/stable/c/c8e84e292ed4cfc199824146da71bb4397b02a1f https://git.kernel.org/stable/c/f96a0606de6bcc8d937b80e6470fd7a174c17e26

Subscriptions

Linux Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-23T11:37:46.984Z

Updated: 2026-10-23T11:37:46.984Z

Reserved: 2026-09-25T10:25:14.378Z

Link: CVE-2026-98888

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-23T12:18:22.583

Modified: 2026-10-23T12:18:22.583

Link: CVE-2026-98888

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-10-23T14:15:07Z

Weaknesses

CWE-665
Improper Initialization

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object