{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-93260","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-09-17T16:02:15.097Z","datePublished":"2026-09-24T15:51:46.703Z","dateUpdated":"2026-10-30T12:36:35.383Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-10-30T12:36:35.383Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/xive: propagate IPI init errors to prevent use-after-free\n\nWhen xive_init_ipis() fails (e.g. irq_domain_alloc_irqs() fails),\nthe error path frees the global xive_ipis array.  However,\nxive_smp_probe() previously ignored this failure and proceeded to\ncall xive_setup_cpu_ipi(), which dereferences the already-freed\nxive_ipis pointer -- a use-after-free.\n\nNow that xive_smp_probe() returns int (previous patch), propagate\nthe error from xive_init_ipis() and xive_setup_cpu_ipi() through\nxive_smp_probe().  Check the return value in both pnv_smp_probe()\nand pSeries_smp_probe() so that IPI setup is aborted cleanly on\nfailure, avoiding the use-after-free."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":7.4,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The UAF is in xive_setup_cpu_ipi() after xive_init_ipis() kfree's xive_ipis, reached only from kernel_init_freeable()->smp_prepare_cpus()->pnv_smp_probe()/pSeries_smp_probe()->xive_smp_probe(); no protocol message or received packet supplies the trigger.\nAC:H - The free-then-use fires only when irq_domain_alloc_irqs() fails in xive_init_ipis()'s for_each_node loop (irq_desc ENOMEM/ENOSPC), after which kfree(xive_ipis) runs; that allocator failure during early SMP probe cannot be induced on demand.\nPR:N - xive_smp_probe() runs as swapper/0 from smp_prepare_cpus() in kernel_init_freeable() before userspace, with no capable() or credential check on pnv_smp_probe() or pSeries_smp_probe().\nUI:N - SMP IPI probe is invoked unconditionally by smp_prepare_cpus() during ordinary boot once xive_core_init() has set __xive_enabled; no victim mount, file open, or other interactive step is required.\nS:U - The dangling xive_ipis dereference corrupts heap in the same Linux instance that runs XIVE (PowerNV host or pSeries guest); it is not a KVM/Xen guest-to-host escape or an IOMMU/DMA boundary bypass.\nC:H - After kfree(xive_ipis) without NULLing, xive_ipi_cpu_to_irq() and xive_request_ipi() read xid->irq and xid->name from the freed xive_ipi_desc array; that heap use-after-free can disclose whatever reclaimed the slab.\nI:H - xive_request_ipi() then atomic_inc_return(&xid->started) on the freed descriptor and request_irq(xid->irq, xive_muxed_ipi_action) using the UAF-read virq, a write-after-free of the xive_ipi_desc slab that can corrupt a reused object and install a handler on the wrong irq.\nA:H - Dereferencing the kfree'd xive_ipis pointer in xive_setup_cpu_ipi() during xive_smp_probe() oopses or panics the kernel while bringing up SMP, so the machine fails to boot."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/powerpc/platforms/powernv/smp.c","arch/powerpc/platforms/pseries/smp.c","arch/powerpc/sysdev/xive/common.c"],"versions":[{"version":"243e25112d06b348f087a6f7aba4bbc288285bdd","lessThan":"89e1caa5b0aafe23e9938d9a311e9d41baee583e","status":"affected","versionType":"git"},{"version":"243e25112d06b348f087a6f7aba4bbc288285bdd","lessThan":"e36b1c2eafcaaddefa70d55e6fda74cf6cda38af","status":"affected","versionType":"git"},{"version":"243e25112d06b348f087a6f7aba4bbc288285bdd","lessThan":"2ea6238343691309e68308131c7e80c3ae05afea","status":"affected","versionType":"git"},{"version":"243e25112d06b348f087a6f7aba4bbc288285bdd","lessThan":"5c9ab0c9cede9f149733d330e2d7d45341b71359","status":"affected","versionType":"git"},{"version":"243e25112d06b348f087a6f7aba4bbc288285bdd","lessThan":"c554a8d376d5aea1b237ed6bef6f9fbfc550e67f","status":"affected","versionType":"git"},{"version":"243e25112d06b348f087a6f7aba4bbc288285bdd","lessThan":"411a3c016e7a95f5fa105a0587e07d0647a77727","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/powerpc/platforms/powernv/smp.c","arch/powerpc/platforms/pseries/smp.c","arch/powerpc/sysdev/xive/common.c"],"versions":[{"version":"4.12","status":"affected"},{"version":"0","lessThan":"4.12","status":"unaffected","versionType":"semver"},{"version":"6.1.191","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.160","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.114","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.57","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2.6","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.12","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.12","versionEndExcluding":"6.6.160"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.12","versionEndExcluding":"6.12.114"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.12","versionEndExcluding":"6.18.57"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.12","versionEndExcluding":"7.2.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.12","versionEndExcluding":"7.3"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/89e1caa5b0aafe23e9938d9a311e9d41baee583e"},{"url":"https://git.kernel.org/stable/c/e36b1c2eafcaaddefa70d55e6fda74cf6cda38af"},{"url":"https://git.kernel.org/stable/c/2ea6238343691309e68308131c7e80c3ae05afea"},{"url":"https://git.kernel.org/stable/c/5c9ab0c9cede9f149733d330e2d7d45341b71359"},{"url":"https://git.kernel.org/stable/c/c554a8d376d5aea1b237ed6bef6f9fbfc550e67f"},{"url":"https://git.kernel.org/stable/c/411a3c016e7a95f5fa105a0587e07d0647a77727"}],"title":"powerpc/xive: propagate IPI init errors to prevent use-after-free","x_generator":{"engine":"bippy-1.2.0"}}}}