CVE-2026-64070
Received Received - Intake

Preempt Count Leak in Linux Kernel powerpc/hv-gpci

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: powerpc/hv-gpci: fix preempt count leak in sysfs show paths Four sysfs show() callbacks in hv-gpci take get_cpu_var(hv_gpci_reqb) (which calls preempt_disable()) but only call the matching put_cpu_var() on the error path under the 'out:' label. Every successful read leaks one preempt_disable(): processor_bus_topology_show() processor_config_show() affinity_domain_via_virtual_processor_show() affinity_domain_via_domain_show() (affinity_domain_via_partition_show() was already correct.) On a CONFIG_PREEMPT=y kernel, repeated reads raise preempt_count and eventually return to userspace with preemption still disabled. The next user-mode page fault then hits faulthandler_disabled() == 1, gets forced to SIGSEGV, and the resulting coredump trips 'BUG: scheduling while atomic' in call_usermodehelper_exec -> wait_for_completion_state -> schedule: BUG: scheduling while atomic: <task>/<pid>/0x00000004 ... __schedule_bug+0x6c/0x90 __schedule+0x58c/0x13a0 schedule+0x48/0x1a0 schedule_timeout+0x104/0x170 wait_for_completion_state+0x16c/0x330 call_usermodehelper_exec+0x254/0x2d0 vfs_coredump+0x1050/0x2590 get_signal+0xb9c/0xc80 do_notify_resume+0xf8/0x470 Add an out_success label that calls put_cpu_var() before returning the byte count, mirroring affinity_domain_via_partition_show().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64070
EUVD
EUVD-2026-45643

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability where four sysfs show() callbacks in the hv-gpci driver leak preempt count. They disable preemption with get_cpu_var() but fail to re-enable it on successful paths, causing preempt_count to increment with each read. On CONFIG_PREEMPT=y kernels, this eventually leads to a scheduling while atomic bug during page faults.

Detection Guidance

This vulnerability is specific to the Linux kernel's hv-gpci driver and can be detected by checking kernel logs for 'scheduling while atomic' errors or preempt_count leaks. Look for messages like 'BUG: scheduling while atomic' in dmesg output. Commands to check include: dmesg | grep -i 'scheduling while atomic' or cat /proc/kmsg | grep -i 'preempt_count'.

Impact Analysis

If exploited, this could crash the system by triggering a 'BUG: scheduling while atomic' error during normal operations. Users might experience unexpected system freezes or forced coredumps when accessing affected sysfs files repeatedly.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a kernel-level issue related to preempt count leaks in sysfs show paths. It may indirectly impact system stability and reliability, which could affect data processing environments subject to these regulations.

Mitigation Strategies

Apply the latest kernel update from your Linux distribution to patch the hv-gpci driver. If an update is not immediately available, disable the hv-gpci driver by unloading the module with 'modprobe -r hv_gpci' or blacklisting it in /etc/modprobe.d/. Monitor kernel logs for any related errors after mitigation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64070. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart