Executive brief
A vulnerability in the Linux kernel's PowerPC architecture support could allow a local user to crash the system. By repeatedly accessing specific system information files, an attacker can cause the kernel to enter an unstable state where it can no longer manage tasks correctly. This leads to a system-wide failure or 'kernel panic,' resulting in a complete service outage.
Technical details
A preemption count leak exists in the hv-gpci driver within the PowerPC architecture of the Linux kernel. Four sysfs show() callbacks (processor_bus_topology_show, processor_config_show, affinity_domain_via_virtual_processor_show, and affinity_domain_via_domain_show) call get_cpu_var(), which disables preemption, but fail to call put_cpu_var() on successful execution paths. On kernels compiled with CONFIG_PREEMPT=y, repeated successful reads of these sysfs entries cause the preempt_count to increment indefinitely. Eventually, this leads to a state where preemption remains disabled when returning to userspace, causing subsequent page faults to trigger a SIGSEGV and a 'scheduling while atomic' BUG, resulting in a kernel panic. The issue is resolved by ensuring put_cpu_var() is called on all exit paths.
Affected products
- Linux Linux Kernel 6.6 to 7.0.11
Timeline
- 2026-07-19: disclosed
- 2026-07-19: advisory