CVE-2026-64070 (GCVE-0-2026-64070)

Vulnerability from cvelistv5 – Published: 2026-07-19 15:39 – Updated: 2026-09-02 12:49
VLAI
Title
powerpc/hv-gpci: fix preempt count leak in sysfs show paths
Summary
In the Linux kernel, the following vulnerability has been resolved: powerpc/hv-gpci: fix preempt count leak in sysfs show paths Four sysfs show() callbacks in hv-gpci take get_cpu_var(hv_gpci_reqb) (which calls preempt_disable()) but only call the matching put_cpu_var() on the error path under the 'out:' label. Every successful read leaks one preempt_disable(): processor_bus_topology_show() processor_config_show() affinity_domain_via_virtual_processor_show() affinity_domain_via_domain_show() (affinity_domain_via_partition_show() was already correct.) On a CONFIG_PREEMPT=y kernel, repeated reads raise preempt_count and eventually return to userspace with preemption still disabled. The next user-mode page fault then hits faulthandler_disabled() == 1, gets forced to SIGSEGV, and the resulting coredump trips 'BUG: scheduling while atomic' in call_usermodehelper_exec -> wait_for_completion_state -> schedule: BUG: scheduling while atomic: <task>/<pid>/0x00000004 ... __schedule_bug+0x6c/0x90 __schedule+0x58c/0x13a0 schedule+0x48/0x1a0 schedule_timeout+0x104/0x170 wait_for_completion_state+0x16c/0x330 call_usermodehelper_exec+0x254/0x2d0 vfs_coredump+0x1050/0x2590 get_signal+0xb9c/0xc80 do_notify_resume+0xf8/0x470 Add an out_success label that calls put_cpu_var() before returning the byte count, mirroring affinity_domain_via_partition_show().
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 71f1c39647d8c9d4d54a861ec81f1ff17544bcb6 , < b300312562fd6e4729697adb9f777f00ca0429f3 (git)
Affected: 71f1c39647d8c9d4d54a861ec81f1ff17544bcb6 , < 45afabe7f99c5d8746434ee41c86584c01d70147 (git)
Affected: 71f1c39647d8c9d4d54a861ec81f1ff17544bcb6 , < b61ebb2826ca1852c2bbd92a676fb622c358cab4 (git)
Affected: 71f1c39647d8c9d4d54a861ec81f1ff17544bcb6 , < 903409000a07ac8e31ffedeb8516f4f8d67150c8 (git)
Affected: 71f1c39647d8c9d4d54a861ec81f1ff17544bcb6 , < dbc30a57bd8e026995e9fa8e8c31cffd18542c01 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.6
Unaffected: 0 , < 6.6 (semver)
Unaffected: 6.6.156 , ≤ 6.6.* (semver)
Unaffected: 6.12.108 , ≤ 6.12.* (semver)
Unaffected: 6.18.49 , ≤ 6.18.* (semver)
Unaffected: 7.0.11 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/powerpc/perf/hv-gpci.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b300312562fd6e4729697adb9f777f00ca0429f3",
              "status": "affected",
              "version": "71f1c39647d8c9d4d54a861ec81f1ff17544bcb6",
              "versionType": "git"
            },
            {
              "lessThan": "45afabe7f99c5d8746434ee41c86584c01d70147",
              "status": "affected",
              "version": "71f1c39647d8c9d4d54a861ec81f1ff17544bcb6",
              "versionType": "git"
            },
            {
              "lessThan": "b61ebb2826ca1852c2bbd92a676fb622c358cab4",
              "status": "affected",
              "version": "71f1c39647d8c9d4d54a861ec81f1ff17544bcb6",
              "versionType": "git"
            },
            {
              "lessThan": "903409000a07ac8e31ffedeb8516f4f8d67150c8",
              "status": "affected",
              "version": "71f1c39647d8c9d4d54a861ec81f1ff17544bcb6",
              "versionType": "git"
            },
            {
              "lessThan": "dbc30a57bd8e026995e9fa8e8c31cffd18542c01",
              "status": "affected",
              "version": "71f1c39647d8c9d4d54a861ec81f1ff17544bcb6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/powerpc/perf/hv-gpci.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.156",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.108",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.49",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.156",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.108",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.49",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/hv-gpci: fix preempt count leak in sysfs show paths\n\nFour sysfs show() callbacks in hv-gpci take get_cpu_var(hv_gpci_reqb)\n(which calls preempt_disable()) but only call the matching put_cpu_var()\non the error path under the \u0027out:\u0027 label. Every successful read leaks\none preempt_disable():\n\n  processor_bus_topology_show()\n  processor_config_show()\n  affinity_domain_via_virtual_processor_show()\n  affinity_domain_via_domain_show()\n\n(affinity_domain_via_partition_show() was already correct.)\n\nOn a CONFIG_PREEMPT=y kernel, repeated reads raise preempt_count and\neventually return to userspace with preemption still disabled. The\nnext user-mode page fault then hits faulthandler_disabled() == 1,\ngets forced to SIGSEGV, and the resulting coredump trips\n\u0027BUG: scheduling while atomic\u0027 in call_usermodehelper_exec -\u003e\nwait_for_completion_state -\u003e schedule:\n\n  BUG: scheduling while atomic: \u003ctask\u003e/\u003cpid\u003e/0x00000004\n  ...\n  __schedule_bug+0x6c/0x90\n  __schedule+0x58c/0x13a0\n  schedule+0x48/0x1a0\n  schedule_timeout+0x104/0x170\n  wait_for_completion_state+0x16c/0x330\n  call_usermodehelper_exec+0x254/0x2d0\n  vfs_coredump+0x1050/0x2590\n  get_signal+0xb9c/0xc80\n  do_notify_resume+0xf8/0x470\n\nAdd an out_success label that calls put_cpu_var() before returning\nthe byte count, mirroring affinity_domain_via_partition_show()."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-02T12:49:39.984Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b300312562fd6e4729697adb9f777f00ca0429f3"
        },
        {
          "url": "https://git.kernel.org/stable/c/45afabe7f99c5d8746434ee41c86584c01d70147"
        },
        {
          "url": "https://git.kernel.org/stable/c/b61ebb2826ca1852c2bbd92a676fb622c358cab4"
        },
        {
          "url": "https://git.kernel.org/stable/c/903409000a07ac8e31ffedeb8516f4f8d67150c8"
        },
        {
          "url": "https://git.kernel.org/stable/c/dbc30a57bd8e026995e9fa8e8c31cffd18542c01"
        }
      ],
      "title": "powerpc/hv-gpci: fix preempt count leak in sysfs show paths",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64070",
    "datePublished": "2026-07-19T15:39:46.536Z",
    "dateReserved": "2026-07-19T07:54:57.030Z",
    "dateUpdated": "2026-09-02T12:49:39.984Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64070",
      "date": "2026-09-21",
      "epss": "0.00122",
      "percentile": "0.02265"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-13T00:00:55.000Z",
      "cve": "CVE-2026-64070",
      "id": "msrc_CVE-2026-64070",
      "initial_release_date": "2026-07-21T01:02:13.000Z",
      "product_status:known_affected": "1",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "powerpc/hv-gpci: fix preempt count leak in sysfs show paths",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-64070.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "arch/powerpc/perf/hv-gpci.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "b300312562fd6e4729697adb9f777f00ca0429f3",
                    "status": "affected",
                    "version": "71f1c39647d8c9d4d54a861ec81f1ff17544bcb6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "45afabe7f99c5d8746434ee41c86584c01d70147",
                    "status": "affected",
                    "version": "71f1c39647d8c9d4d54a861ec81f1ff17544bcb6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b61ebb2826ca1852c2bbd92a676fb622c358cab4",
                    "status": "affected",
                    "version": "71f1c39647d8c9d4d54a861ec81f1ff17544bcb6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "903409000a07ac8e31ffedeb8516f4f8d67150c8",
                    "status": "affected",
                    "version": "71f1c39647d8c9d4d54a861ec81f1ff17544bcb6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "dbc30a57bd8e026995e9fa8e8c31cffd18542c01",
                    "status": "affected",
                    "version": "71f1c39647d8c9d4d54a861ec81f1ff17544bcb6",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "arch/powerpc/perf/hv-gpci.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.6"
                  },
                  {
                    "lessThan": "6.6",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.156",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.108",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.49",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.*",
                    "status": "unaffected",
                    "version": "7.0.11",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "DDA7609B-20E6-4693-89F8-922330949914",
                    "versionEndExcluding": "6.6.156",
                    "versionStartIncluding": "6.6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "DDCDC5AE-8755-4098-8ED3-36869DF2EEE6",
                    "versionEndExcluding": "6.12.108",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D1656D23-D7CC-49A6-AD07-8B5033A14855",
                    "versionEndExcluding": "6.18.49",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "0520D091-FC52-4A50-AF07-70AE7D08B750",
                    "versionEndExcluding": "7.0.11",
                    "versionStartIncluding": "6.19",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/hv-gpci: fix preempt count leak in sysfs show paths\n\nFour sysfs show() callbacks in hv-gpci take get_cpu_var(hv_gpci_reqb)\n(which calls preempt_disable()) but only call the matching put_cpu_var()\non the error path under the \u0027out:\u0027 label. Every successful read leaks\none preempt_disable():\n\n  processor_bus_topology_show()\n  processor_config_show()\n  affinity_domain_via_virtual_processor_show()\n  affinity_domain_via_domain_show()\n\n(affinity_domain_via_partition_show() was already correct.)\n\nOn a CONFIG_PREEMPT=y kernel, repeated reads raise preempt_count and\neventually return to userspace with preemption still disabled. The\nnext user-mode page fault then hits faulthandler_disabled() == 1,\ngets forced to SIGSEGV, and the resulting coredump trips\n\u0027BUG: scheduling while atomic\u0027 in call_usermodehelper_exec -\u003e\nwait_for_completion_state -\u003e schedule:\n\n  BUG: scheduling while atomic: \u003ctask\u003e/\u003cpid\u003e/0x00000004\n  ...\n  __schedule_bug+0x6c/0x90\n  __schedule+0x58c/0x13a0\n  schedule+0x48/0x1a0\n  schedule_timeout+0x104/0x170\n  wait_for_completion_state+0x16c/0x330\n  call_usermodehelper_exec+0x254/0x2d0\n  vfs_coredump+0x1050/0x2590\n  get_signal+0xb9c/0xc80\n  do_notify_resume+0xf8/0x470\n\nAdd an out_success label that calls put_cpu_var() before returning\nthe byte count, mirroring affinity_domain_via_partition_show()."
          }
        ],
        "id": "CVE-2026-64070",
        "lastModified": "2026-09-03T15:11:27.580",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2026-07-19T16:17:47.583",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/45afabe7f99c5d8746434ee41c86584c01d70147"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/903409000a07ac8e31ffedeb8516f4f8d67150c8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/b300312562fd6e4729697adb9f777f00ca0429f3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/b61ebb2826ca1852c2bbd92a676fb622c358cab4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/dbc30a57bd8e026995e9fa8e8c31cffd18542c01"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-Other"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-09-03T16:05:47+00:00",
      "cve": "CVE-2026-64070",
      "id": "CVE-2026-64070",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: powerpc/hv-gpci: fix preempt count leak in sysfs show paths",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64070.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:56:25Z",
      "cve": "CVE-2026-64070",
      "id": "CVE-2026-64070",
      "initial_release_date": "2026-07-21T13:00:15Z",
      "product_status:known_affected": "123",
      "product_status:known_not_affected": "251",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64070",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64070.json",
      "version": "6"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.