CVE-2026-64214 Overview
CVE-2026-64214 is a Linux kernel vulnerability in the PowerPC architecture-specific timer code. The flaw resides in arch_irq_work_raise(), which called preempt_disable()/preempt_enable() while handling Machine Check Exceptions (MCE) in real mode. Accessing preempt_count from real mode context triggers a kernel panic with an unhandled data access fault. The bug was resolved by removing the redundant preemption guards, since callers already disable preemption before reaching this path and MCE handlers execute in NMI context with MSR[EE]=0.
Critical Impact
A machine check exception raised from real mode causes a kernel panic (denial of service) on affected PowerPC Linux systems.
Affected Products
- Linux kernel (PowerPC architecture)
- arch/powerpc/kernel/time.c — arch_irq_work_raise() function
- Stable branches tracked via the referenced kernel.org commits
Discovery Timeline
- 2026-07-24 - CVE-2026-64214 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-64214
Vulnerability Analysis
The defect resides in the PowerPC implementation of arch_irq_work_raise() in arch/powerpc/kernel/time.c. The function is invoked to raise self-IPI style irq_work notifications. When called from the machine check exception handler through machine_check_queue_event(), execution occurs in real mode with the MMU disabled.
The crash signature shows a bad kernel data access at address 0xc00000006be21300 inside arch_irq_work_raise+0x10/0x70, called from machine_check_queue_event+0xa8/0x150 and machine_check_early_common+0x1f0/0x2c0. The MSR value 8000000000001003 indicates real-mode execution with external interrupts disabled.
Root Cause
The function called preempt_disable() and preempt_enable() to guard against races when raising irq_work from exception context. Those guards were introduced by commit 0fe1ac48bef0 ("powerpc/perf_event: Fix oops due to perf_event_do_pending call"). Subsequent commits 471ba0e686cb and 20b876918c06 moved equivalent preemption protection up into irq_work_queue() and irq_work_queue_on(), making the guards inside arch_irq_work_raise() redundant.
Accessing preempt_count requires normal memory translation. In real mode the required mappings are unavailable, so the access faults and the kernel panics [CWE-476-adjacent kernel fault behavior].
Attack Vector
This is a reliability defect rather than a remotely exploitable condition. Triggering the panic requires a machine check exception on PowerPC hardware while the kernel processes irq_work from real mode. Any workload that generates MCEs — memory errors, hardware faults, or hypervisor-injected checks — can induce the panic. The impact is a denial of service on the affected host.
No public exploit code or proof-of-concept exists. See the upstream fix commit for the exact patch content.
Detection Methods for CVE-2026-64214
Indicators of Compromise
- Kernel oops log lines referencing arch_irq_work_raise+0x10/0x70 and machine_check_queue_event
- BUG: Unable to handle kernel data access on read messages preceded by machine check handling frames
- MSR: 8000000000001003 (real-mode, MMU-off) in the panic register dump on PowerPC hosts
- Unexpected node reboots on PowerPC systems following memory or hardware error events
Detection Strategies
- Correlate kernel panics with prior MCE log entries in /var/log/messages, dmesg, or journalctl -k
- Inspect running kernel version against the fixed stable branches listed in the kernel.org references
- Enable kdump on PowerPC hosts to capture vmcore images for post-mortem confirmation of the crash frame
Monitoring Recommendations
- Forward kernel logs from PowerPC endpoints to a centralized log platform and alert on machine check events
- Track host availability and unplanned reboots for PowerPC systems in the fleet
- Review firmware and hardware health telemetry that precedes MCE generation, such as memory ECC counters
How to Mitigate CVE-2026-64214
Immediate Actions Required
- Inventory PowerPC Linux hosts and identify kernels that do not include the fix
- Schedule kernel updates to a stable release that carries one of the referenced commits
- Ensure kdump is configured so any recurrence produces a vmcore for verification
Patch Information
The fix removes the preempt_disable()/preempt_enable() pair from arch_irq_work_raise() in arch/powerpc/kernel/time.c. Stable-tree backports are available in the following commits: 31467b23823ffec1f6fff407f8e3ca9af8b7491a, 51860e423592893cd7bfa7287d99a3aff4dc3a9d, 6dcd072a5ae3aed336e4a67a7d4cc5205b240065, 72d8d1c36452a4d3ee134b1da48de7518c1329f9, 8079acc5ee5235a627e4586d4f42082a9000ea64, and a09d07ac45e283c9861a9ceea06f56d0ba851d22. Rebuild or install the vendor-supplied kernel package that bundles these changes.
Workarounds
- No supported runtime workaround exists; the bug lives in an NMI-context code path that cannot be disabled
- Reduce exposure by addressing underlying hardware issues that trigger machine check exceptions, such as failing DIMMs
- Migrate critical workloads off affected PowerPC hosts until the patched kernel is deployed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
