Executive brief
A vulnerability in the Linux kernel's memory management for PowerPC systems could allow a local user to cause a system crash or potentially gain unauthorized access. The issue occurs when the system incorrectly manages internal memory address caches (SLB) while moving processes between different processor cores. This can lead to a 'multi-hit' error, which destabilizes the operating system and impacts service availability.
Technical details
A vulnerability exists in the PowerPC 64-bit (64s) architecture implementation of the Linux kernel when using Hash Memory Management Units (MMU). The kernel's SLB preload cache, which mirrors hardware SLB entries, can become desynchronized from the hardware state during task migration between CPUs. Specifically, when a process migrates back to a CPU where it previously ran, the kernel may skip a full MMU context switch if the memory structures appear identical, leaving stale entries in the hardware SLB. Subsequent attempts to reload these entries via 'preload_new_slb_context' or 'slb_setup_new_exec' trigger a hardware SLB multi-hit error. The fix involves removing redundant preload functions to ensure the hardware and software caches remain synchronized.
Affected products
- Linux Linux Kernel 5.10 through 6.13 (PowerPC 64-bit Hash MMU)
Timeline
- 2025-10-30: other: Initial patch authored
- 2026-01-13: disclosed: CVE published
- 2026-01-19: patched: Patch committed to stable tree
References
- https://git.kernel.org/stable/c/00312419f0863964625d6dcda8183f96849412c6
- https://git.kernel.org/stable/c/01324c0328181b94cf390bda22ff91c75126ea57
- https://git.kernel.org/stable/c/2e9a95d60f1df7b57618fd5ef057aef331575bd2
- https://git.kernel.org/stable/c/4ae1e46d8a290319f33f71a2710a1382ba5431e8
- https://git.kernel.org/stable/c/895123c309a34d2cfccf7812b41e17261a3a6f37
- https://git.kernel.org/stable/c/b13a3dbfa196af68eae2031f209743735ad416bf
- https://git.kernel.org/stable/c/c9f865022a1823d814032a09906e91e4701a35fc