Executive brief
The Linux kernel's ARM64 architecture contains a race condition in EFI runtime services when software-based Privilege Access Never (PAN) protection is enabled. A voluntary preemption during floating-point context switching can cause the kernel to access memory with an incorrect page table configuration, resulting in a kernel crash. This primarily affects systems using ARM64 processors with EFI firmware support and software PAN enabled.
Technical details
This is a race condition vulnerability in arch/arm64/kernel/efi.c where the fpsimd (floating-point SIMD) context switching code (__efi_fpsimd_begin()) can voluntarily preempt before the page table is switched. When preemption occurs and the scheduler switches context, the deferred mm switching used by the software PAN implementation (CONFIG_ARM64_SW_TTBR0_PAN) leaves TTBR0_EL1 in an inconsistent state. Upon return to the EFI code, the kernel attempts to access memory through the incorrect page table mapping, triggering a translation fault. The fix reorders the fpsimd setup to occur before changing the page table, preventing preemption from occurring during the critical page table switch. No exploit code exists, and this affects kernel builds with both EFI runtime services support and software PAN enabled.
Affected products
- Linux Linux kernel 5.0 and later (prior to fix commit e98a9d0146372b046d863164025a66ab4488b972)
Timeline
- 2026-09-17: disclosed: CVE published
- 2026-08-11: patched: Upstream fix committed by Will Deacon
- 2026-09-14: patched: Fix backported to stable kernel series