CVE-2026-64070: Linux Kernel Privilege Escalation Flaw

CVE-2026-64070 Overview

CVE-2026-64070 is a Linux kernel vulnerability in the PowerPC hv-gpci (Hypervisor Get Performance Counter Info) driver. Four sysfsshow() callbacks call get_cpu_var(hv_gpci_reqb), which invokes preempt_disable(), but fail to call the matching put_cpu_var() on the success path. Every successful read leaks one preempt_disable() reference, incrementing the preempt count without a corresponding decrement.

On a CONFIG_PREEMPT=y kernel, repeated reads eventually return to userspace with preemption still disabled. Subsequent user-mode page faults trigger SIGSEGV and produce a BUG: scheduling while atomic warning during coredump handling.

Critical Impact
Repeated reads of affected sysfs attributes on PowerPC systems corrupt the preempt counter, leading to kernel scheduling failures and process termination.

Affected Products

Linux kernel PowerPC architecture with hv-gpci driver
Kernels built with CONFIG_PREEMPT=y
IBM Power systems exposing hv-gpcisysfs interfaces

Discovery Timeline

2026-07-19 - CVE-2026-64070 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-64070

Vulnerability Analysis

The defect resides in the PowerPC hv-gpci performance counter driver. Four sysfsshow() callbacks acquire a per-CPU variable via get_cpu_var(hv_gpci_reqb), which disables kernel preemption. The matching put_cpu_var() call only executes on the error path under the out: label. Successful reads return the byte count directly without re-enabling preemption.

The affected callbacks are processor_bus_topology_show(), processor_config_show(), affinity_domain_via_virtual_processor_show(), and affinity_domain_via_domain_show(). The related affinity_domain_via_partition_show() handler was implemented correctly and is not affected. This is classified as a resource management defect resulting in a preempt count leak [CWE-772].

Root Cause

The root cause is asymmetric locking. get_cpu_var() increments the preempt counter via preempt_disable(), but the success path returns without calling put_cpu_var(). Each successful sysfs read leaves the preempt counter one higher than it should be. Over repeated reads, the counter grows without bound.

Attack Vector

Any process with read access to the affected sysfs attributes can trigger the leak. Repeatedly reading these files pushes the preempt counter high enough that the calling task returns to userspace while preemption is still disabled. The next page fault hits faulthandler_disabled() == 1, forcing a SIGSEGV. Coredump generation then invokes call_usermodehelper_exec → wait_for_completion_state → schedule, producing a BUG: scheduling while atomic message and destabilizing the kernel scheduler state.

The fix introduces an out_success label that calls put_cpu_var() before returning the byte count, mirroring the correct pattern already used in affinity_domain_via_partition_show(). See the upstream patches Git Kernel Commit 9034090 and Git Kernel Commit dbc30a5 for the exact change.

Detection Methods for CVE-2026-64070

Indicators of Compromise

Kernel log messages containing BUG: scheduling while atomic originating from call_usermodehelper_exec and vfs_coredump call chains.
Unexpected SIGSEGV terminations on processes performing routine page faults on PowerPC systems.
Unexplained increases in preempt_count observable via kernel debug interfaces after sysfs reads under /sys/devices/hv_gpci/.

Detection Strategies

Audit process activity for repeated reads of hv-gpcisysfs attributes such as processor_bus_topology, processor_config, affinity_domain_via_virtual_processor, and affinity_domain_via_domain.
Monitor dmesg and journal output for __schedule_bug stack traces referencing wait_for_completion_state and schedule_timeout.
Correlate crashes on PowerPC hosts with preceding sysfs reads under the hv-gpci device tree.

Monitoring Recommendations

Enable kernel lockdep and PREEMPT_DEBUG on test systems to catch preempt count imbalances early.
Ship kernel logs to a centralized store and alert on scheduling while atomic patterns.
Track kernel package versions across PowerPC fleets to confirm patched builds are deployed.

How to Mitigate CVE-2026-64070

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in Git Kernel Commit 9034090 and Git Kernel Commit dbc30a5.
Update to a distribution kernel that includes the hv-gpciput_cpu_var() fix on all affected PowerPC hosts.
Restart affected systems after patching to clear any accumulated preempt counter drift.

Patch Information

The fix adds an out_success label in each affected show() callback that calls put_cpu_var(hv_gpci_reqb) before returning the byte count. This mirrors the pattern used in affinity_domain_via_partition_show(). Distribution vendors are backporting the patches to stable kernel branches.

Workarounds

Restrict read access on /sys/devices/hv_gpci/ attributes to trusted administrators until the kernel is patched.
Avoid running performance monitoring tooling that repeatedly polls the affected hv-gpcisysfs files.
On non-critical systems, rebuild with CONFIG_PREEMPT=n to reduce exposure to the scheduling-while-atomic condition.

bash

# Restrict read access to hv-gpci sysfs attributes as a temporary workaround
chmod 600 /sys/devices/hv_gpci/processor_bus_topology
chmod 600 /sys/devices/hv_gpci/processor_config
chmod 600 /sys/devices/hv_gpci/affinity_domain_via_virtual_processor
chmod 600 /sys/devices/hv_gpci/affinity_domain_via_domain