Executive brief
The Linux kernel's OpenRISC architecture implementation contains a flaw in how it synchronizes instruction caches across multiple processor cores when updating dynamic code patches (jump labels). This causes static keys to retain stale code after being updated, potentially leading to unpredictable kernel behavior or security bypasses on multi-core OpenRISC systems.
Technical details
The vulnerability stems from incorrect cache synchronization in the jump_label implementation for OpenRISC (arch/openrisc/kernel/jump_label.c). The original code inherited from ARM64 uses kick_all_cpus_sync() to invalidate remote instruction caches, but this does not properly flush all icache lines on OpenRISC systems. Additionally, data cache flushing was missing for systems without CONFIG_DCACHE_WRITETHROUGH. The fix replaces kick_all_cpus_sync() with icache_all_inv() for proper remote icache invalidation and adds conditional dcache range flushing in the patching code. This is a local issue affecting only multi-core OpenRISC systems; no network attack vector exists.
Affected products
- Linux Linux Kernel OpenRISC architecture (affected since commit 8c30b0018f9d, fixed in commit aca063c9024522e4e5b9a9d1927433f6a01785a3)
Timeline
- 2026-05-22: other: Fix commit authored by Stafford Horne
- 2026-07-24: other: Patch merged by Greg Kroah-Hartman
- 2026-08-15: disclosed: CVE-2026-72154 published