All vulnerabilities
CVE-2026-93260

Linux: powerpc/xive: propagate IPI init errors to prevent use-after-free

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
7.4High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.14%Chance of exploitation activity in the next 30 days, higher than 3% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2ea6238343691309e68308131c7e80c3ae05afeaAlso 5c9ab0c9cede9f149733d330e2d7d45341b71359, 411a3c016e7a95f5fa105a0587e07d0647a77727CVE List
Published24 Sep 2026Updated 21 Oct 2026CVE List

What fixes it

  • 2ea6238343691309e68308131c7e80c3ae05afeaLinuxCVE List
  • 5c9ab0c9cede9f149733d330e2d7d45341b71359LinuxCVE List
  • 411a3c016e7a95f5fa105a0587e07d0647a77727LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

powerpc/xive: propagate IPI init errors to prevent use-after-free

When xive_init_ipis() fails (e.g. irq_domain_alloc_irqs() fails), the error path frees the global xive_ipis array. However, xive_smp_probe() previously ignored this failure and proceeded to call xive_setup_cpu_ipi(), which dereferences the already-freed xive_ipis pointer -- a use-after-free.

Now that xive_smp_probe() returns int (previous patch), propagate the error from xive_init_ipis() and xive_setup_cpu_ipi() through xive_smp_probe(). Check the return value in both pnv_smp_probe() and pSeries_smp_probe() so that IPI setup is aborted cleanly on failure, avoiding the use-after-free.

Text from CVE List

Affected versions 12

  • Linuxaffected: 243e25112d06b348f087a6f7aba4bbc288285bdd before e36b1c2eafcaaddefa70d55e6fda74cf6cda38afCVE List
  • Linuxaffected: 243e25112d06b348f087a6f7aba4bbc288285bdd before 2ea6238343691309e68308131c7e80c3ae05afeaCVE List
  • Linuxaffected: 243e25112d06b348f087a6f7aba4bbc288285bdd before 5c9ab0c9cede9f149733d330e2d7d45341b71359CVE List
  • Linuxaffected: 243e25112d06b348f087a6f7aba4bbc288285bdd before c554a8d376d5aea1b237ed6bef6f9fbfc550e67fCVE List
  • Linuxaffected: 243e25112d06b348f087a6f7aba4bbc288285bdd before 411a3c016e7a95f5fa105a0587e07d0647a77727CVE List
  • Linuxaffected: 4.12CVE List
  • Linuxunaffected: all versions before 4.12CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.114 through 6.12.*CVE List
  • Linuxunaffected: 6.18.57 through 6.18.*CVE List
  • Linuxunaffected: 7.2.6 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5