LiveActive security incident?Get immediate response
CVE Record

CVE-2026-64070: powerpc/hv-gpci: fix preempt count leak in sysfs show paths

In the Linux kernel, the following vulnerability has been resolved: powerpc/hv-gpci: fix preempt count leak in sysfs show paths Four sysfs show() callbacks in hv-gpci take get_cpu_var(hv_gpci_reqb) (which calls preempt_disable()) but only call the matching put_cpu_var() on the error path under the 'out:' label. Every successful read leaks one preempt_disable(): processor_bus_topology_show() processor_config_show() affinity_domain_via_virtual_processor_show() affinity_domain_via_domain_show() (affinity_domain_via_partition_show() was already correct.) On a CONFIG_PREEMPT=y kernel, repeated reads raise preempt_count and eventually return to userspace with preemption still disabled. The next user-mode page fault then hits faulthandler_disabled() == 1, gets forced to SIGSEGV, and the resulting coredump trips 'BUG: scheduling while atomic' in call_usermodehelper_exec -> wait_for_completion_state -> schedule: BUG: scheduling while atomic: <task>/<pid>/0x00000004 ... __schedule_bug+0x6c/0x90 __schedule+0x58c/0x13a0 schedule+0x48/0x1a0 schedule_timeout+0x104/0x170 wait_for_completion_state+0x16c/0x330 call_usermodehelper_exec+0x254/0x2d0 vfs_coredump+0x1050/0x2590 get_signal+0xb9c/0xc80 do_notify_resume+0xf8/0x470 Add an out_success label that calls put_cpu_var() before returning the byte count, mirroring affinity_domain_via_partition_show().

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This Linux kernel flaw affects specific PowerPC hypervisor performance/sysfs paths. Repeated successful reads can leave preemption disabled, causing later user-mode faults to turn into crashes and kernel scheduling bugs. The likely business impact is local stability risk, not proven remote compromise.

Executive priority

Treat as a targeted stability issue for affected PowerPC Linux fleets. Prioritize patching where shared local access or critical workloads exist. It is not currently supported by sources as internet-exploited or remotely exploitable.

Technical view

Four hv-gpci sysfs show() callbacks call get_cpu_var(), which disables preemption, but missed put_cpu_var() on successful returns. On CONFIG_PREEMPT=y kernels, repeated reads can leak preempt_count and trigger SIGSEGV plus 'BUG: scheduling while atomic'. Stable kernel commits add a successful-return cleanup path.

Likely exposure

Exposure appears limited to Linux on PowerPC systems using hv-gpci sysfs paths with CONFIG_PREEMPT=y. The source bundle lists Linux versions including 6.6 through 7.0.11/7.1 as affected, but packaging and distribution backports require vendor confirmation.

Exploitation context

No source states active exploitation, and KEV is false. The described trigger is repeated local reading of affected sysfs attributes, leading to denial-of-service or instability symptoms rather than documented privilege escalation or remote code execution.

Researcher notes

The vulnerable functions are processor_bus_topology_show(), processor_config_show(), affinity_domain_via_virtual_processor_show(), and affinity_domain_via_domain_show(). affinity_domain_via_partition_show() was already correct. Version data in the CVE bundle is sparse; confirm exact affected ranges against kernel and distribution advisories.

Mitigation direction

  • Apply a vendor kernel update containing the referenced stable fixes.
  • If no package is available, track distribution advisories for backported fixes.
  • Prioritize PowerPC systems exposing hv-gpci sysfs interfaces.
  • Consider reducing unnecessary local user access until patched, where operationally feasible.

Validation and detection

  • Identify PowerPC Linux systems in inventory.
  • Check whether kernels are built with CONFIG_PREEMPT=y.
  • Confirm whether hv-gpci sysfs attributes are present.
  • Verify installed kernel includes the referenced stable commits or vendor backports.
  • Review logs for 'BUG: scheduling while atomic' patterns.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-64070 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
3Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux71f1c39647d8c9d4d54a861ec81f1ff17544bcb6, 71f1c39647d8c9d4d54a861ec81f1ff17544bcb6unaffected
LinuxLinux6.6, 0, 7.0.11, 7.1affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.