Executive brief
A vulnerability in the Linux kernel's pseries platform driver could allow a local user to cause a system deadlock. This occurs when specific hardware communication tasks are interrupted, potentially leading to a complete system freeze or denial of service. This affects IBM Power Systems (pseries) running Linux that utilize the PAPR hypervisor pipe interface.
Technical details
A race condition exists in the papr-hvpipe character driver within the Linux kernel's pseries platform code. The vulnerability is rooted in the `->ioctl` and `->release` handlers, which previously used standard spinlocks (`spin_lock`) that did not disable local interrupts. If an interrupt occurs on the same CPU while these handlers hold the `hvpipe_src_list_lock`, and the interrupt handler attempts to acquire the same lock, a circular dependency (deadlock) occurs. The fix involves migrating to `spin_lock_irqsave` and `spin_lock_irqrestore` to ensure interrupts are disabled while the lock is held. This is a local denial-of-service vulnerability.
Affected products
- Linux Linux Kernel pseries/papr-hvpipe driver
Timeline
- 2026-05-01: other: Patch authored
- 2026-06-08: disclosed: CVE published