Executive brief
A vulnerability in the Linux kernel's handling of EFI firmware can cause systems to completely freeze or crash. This occurs when the kernel incorrectly identifies a firmware error as a critical system interrupt, preventing it from recovering gracefully. On affected hardware, common operations like checking the system time could trigger an unrecoverable system hang, impacting service availability.
Technical details
A regression was introduced in the Linux kernel's x86 EFI platform quirks where changes to FPU softirq handling caused the 'in_interrupt()' check to return true during EFI runtime service calls. Specifically, the use of 'local_bh_disable()' sets 'SOFTIRQ_OFFSET' in 'preempt_count'. When buggy EFI firmware triggers a page fault (e.g., during 'GetTime()'), the 'efi_crash_gracefully_on_page_fault()' handler incorrectly bails out because it believes it is in a real interrupt context. This causes the fault to escalate to 'die()', which then triggers a 'Fatal exception in interrupt' panic. The fix replaces 'in_interrupt()' with '!in_task()' to correctly identify the context and allow graceful recovery via 'EFI_ABORTED'.
Affected products
- Linux Linux kernel x86 architecture with EFI runtime services
Timeline
- 2026-04-30: other: Patch authored
- 2026-05-14: patched: Patch committed to stable tree
- 2026-06-08: disclosed: CVE published