Executive brief
A flaw in the Linux kernel's PowerPC performance monitoring subsystem can cause a preemption counter to underflow, leading to kernel panic ("scheduling while atomic" error) on systems with preemption enabled. This affects PowerPC-based systems and can cause system instability or denial of service when performance event monitoring is used.
Technical details
The vulnerability is a logic error in the fsl_emb_pmu_del() function in arch/powerpc/perf/core-fsl-emb.c. The function unconditionally calls put_cpu_var(cpu_hw_events) at the 'out:' label to release per-CPU resources, but only calls the matching get_cpu_var() after an early-return check. When event->hw.idx is negative, the function jumps directly to 'out:' without acquiring the per-CPU variable, causing an unmatched preempt_enable() that underflows the preemption counter. On CONFIG_PREEMPT=y kernels, this eventually triggers a "scheduling while atomic" BUG. The fix moves put_cpu_var() to correctly pair with get_cpu_var(), ensuring the per-CPU access is properly bracketed. The patch has been merged into the Linux kernel stable tree.
Affected products
- Linux Linux Kernel Multiple versions (upstream fixed, backported to stable branches)
Timeline
- 2026-08-28: disclosed: CVE published
- 2026-06-05: patched: Fix committed upstream (commit 81e3a86030462824a67d697739cf3f387f4ba350)