CVE-2026-80611 Overview
CVE-2026-80611 affects the Linux kernel's Advanced Configuration and Power Interface (ACPI) processor idle subsystem. The flaw arises when function tracing or Kprobes is enabled and a CPU enters an ACPI Low Power Idle (LPI) state. The acpi_idle_lpi_enter() function runs after Read-Copy-Update (RCU) has been disabled for the local CPU, causing ftrace's function_trace_call() to emit an RCU warning.
Critical Impact
The issue produces kernel warnings and RCU splats during idle entry when tracing is active, indicating a violation of RCU quiescent state invariants along the cpuidle path.
Affected Products
- Linux kernel ACPI: processor_idle subsystem
- Generic __weak stub for acpi_processor_ffh_lpi_enter()
- RISC-V implementation of acpi_processor_ffh_lpi_enter()
Discovery Timeline
- 2026-08-28 - CVE-2026-80611 published to the National Vulnerability Database
- 2026-08-28 - Last updated in NVD database
Technical Details for CVE-2026-80611
Vulnerability Analysis
The Linux cpuidle subsystem disables RCU for the local CPU before invoking architecture and firmware-specific idle entry routines. The acpi_idle_lpi_enter() function is called along this path but was not marked as a cpuidle function. When ftrace or Kprobes instruments the function, the tracer calls function_trace_call(), which asserts that RCU is watching the current CPU. Because RCU has already been disabled, the assertion fails and the kernel emits: RCU not on for: acpi_idle_lpi_enter+0x4/0xd8 followed by a WARNING at include/linux/trace_recursion.h:162.
The warning surfaces every time the affected CPU enters an ACPI LPI state with tracing enabled. Repeated warnings pollute kernel logs and can indicate deeper trace-recursion issues on power-managed platforms, including RISC-V systems that implement Firmware First Handling (FFH) for LPI.
Root Cause
The root cause is missing __cpuidle annotation on functions that execute after RCU has stopped watching the local CPU. Without the annotation, the compiler does not place the functions in the .cpuidle.text section, and ftrace does not exclude them from instrumentation. Tracing then runs in an RCU-quiescent context, violating tracer preconditions.
Attack Vector
This is a kernel correctness issue triggered by legitimate diagnostic activity rather than a remotely exploitable vulnerability. The condition manifests only when function tracing or Kprobes is enabled by a privileged user on a system that enters ACPI LPI idle states. There is no evidence of remote exploitation, and the CVE has no assigned CVSS score, no Common Weakness Enumeration (CWE) identifier, and no listing in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.168%.
The vulnerability is described in prose per the upstream patch series; no proof-of-concept code is applicable. Refer to the Linux Kernel Patch (10f6759) for the source-level change.
Detection Methods for CVE-2026-80611
Indicators of Compromise
- Kernel log entries containing RCU not on for: acpi_idle_lpi_enter on systems using ACPI LPI.
- WARNING: CPU: <n> PID: 0 at include/linux/trace_recursion.h:162 function_trace_call messages during idle transitions.
- Repeated ftrace-related splats coinciding with cpuidle governor selection of an LPI state.
Detection Strategies
- Aggregate dmesg and journalctl -k output across Linux fleets and alert on the specific RCU and trace_recursion warning strings.
- Correlate the warnings with tracing activation events (echo function > /sys/kernel/tracing/current_tracer) or Kprobe registrations.
- Inventory kernel builds and identify hosts running unpatched versions on ARM64 and RISC-V platforms that expose ACPI LPI.
Monitoring Recommendations
- Ship kernel logs to a centralized analytics platform and build a saved query for the acpi_idle_lpi_enter warning signature.
- Track occurrences over time to confirm patch effectiveness after kernel updates.
- Include ACPI cpuidle warnings in performance-engineering health checks for tracing-enabled diagnostic environments.
How to Mitigate CVE-2026-80611
Immediate Actions Required
- Apply the stable kernel updates that mark acpi_idle_lpi_enter(), the generic __weak stub, and the RISC-V acpi_processor_ffh_lpi_enter() with __cpuidle.
- Rebuild custom kernels against the patched sources referenced in the upstream commits.
- Reboot affected hosts to load the fixed kernel image and validate that no LPI-related RCU warnings recur.
Patch Information
Upstream fixes are available in the mainline and stable trees. See Linux Kernel Patch (10f6759), Linux Kernel Patch (5b6165d), Linux Kernel Patch (8bbe4dd), and Linux Kernel Patch (956ca5d). The fix moves the affected functions into the .cpuidle.text section, implicitly marking them notrace.
Workarounds
- Disable function tracing on affected kernels by ensuring /sys/kernel/tracing/current_tracer remains set to nop until the patch is deployed.
- Avoid registering Kprobes on acpi_idle_lpi_enter or related cpuidle entry paths.
- On platforms where LPI is optional, consider limiting the cpuidle governor to non-LPI states during troubleshooting sessions that require ftrace.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.