CVE-2026-80626: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-80626 Overview

CVE-2026-80626 is a Linux kernel vulnerability in the PowerPC performance monitoring subsystem. The flaw resides in the fsl_emb_pmu_del() function within the powerpc/perf code path. An unconditional call to put_cpu_var(cpu_hw_events) at the out: label executes without a matching get_cpu_var() when event->hw.idx is negative. This mismatch causes a preempt count underflow on kernels built with CONFIG_PREEMPT=y. The corrupted preempt count eventually surfaces as a scheduling while atomic BUG, destabilizing the kernel scheduler.

Critical Impact
Local users on affected PowerPC systems can trigger kernel instability and denial of service through legitimate perf subsystem operations that reach the vulnerable early-return path.

Affected Products

Linux kernel builds targeting PowerPC embedded (fsl_emb) platforms
Kernels compiled with CONFIG_PREEMPT=y using the Freescale embedded PMU driver
Multiple stable kernel branches referenced by the upstream fix commits

Discovery Timeline

2026-08-28 - CVE-2026-80626 published to the National Vulnerability Database
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-80626

Vulnerability Analysis

The fsl_emb_pmu_del() function manages the removal of performance monitoring events on Freescale embedded PowerPC processors. The function accesses the cpu_hw_events per-CPU variable through the get_cpu_var() / put_cpu_var() API. These macros pair a preemption disable with a subsequent preemption enable to guarantee safe per-CPU data access.

The defective control flow places get_cpu_var(cpu_hw_events) after an early-return check on event->hw.idx. When the index is negative, execution jumps directly to the out: label without ever taking the corresponding get_cpu_var(). The out: label then unconditionally invokes put_cpu_var(cpu_hw_events), issuing an unmatched preempt_enable().

Root Cause

The root cause is an unbalanced pairing of preemption-control primitives across a control-flow branch. This is a race condition and locking discipline defect: the code violates the invariant that every get_cpu_var() must be matched by exactly one put_cpu_var() on all execution paths. The fix relocates put_cpu_var() so that percpu access is correctly bracketed, and the out: label only handles perf_pmu_enable.

Attack Vector

Exploitation requires local access to invoke the perf subsystem on an affected PowerPC kernel. A user or process that removes a perf event whose hardware index has not been assigned drives execution through the flawed early-return path. Each traversal decrements preempt_count without a corresponding increment. On CONFIG_PREEMPT=y builds, repeated triggering produces preempt count underflow and eventually a scheduling while atomic BUG, rendering the system unstable.

No verified exploit code is available. See the upstream patches for technical details, including commit 67aeb1eb93d4 and commit b504fd953664.

Detection Methods for CVE-2026-80626

Indicators of Compromise

Kernel log entries containing BUG: scheduling while atomic originating from perf event teardown
Warnings such as preempt_count underflowed or unexpected preempt_count values in dmesg
Kernel oops or soft-lockup traces referencing fsl_emb_pmu_del in the backtrace

Detection Strategies

Inventory PowerPC systems and identify kernels built with CONFIG_PREEMPT=y that use the Freescale embedded PMU driver
Correlate perf subsystem usage by unprivileged processes with subsequent scheduler warnings
Compare running kernel commit hashes against the upstream stable fixes referenced in the advisory

Monitoring Recommendations

Forward kernel ring buffer output (dmesg, /var/log/kern.log) to a centralized logging pipeline for pattern matching on preemption warnings
Alert on repeated scheduling while atomic messages, which indicate kernel state corruption
Track unexpected reboots or scheduler stalls on PowerPC embedded fleets as potential downstream symptoms

How to Mitigate CVE-2026-80626

Immediate Actions Required

Apply the upstream stable kernel patches that reorder put_cpu_var() to pair with get_cpu_var() in fsl_emb_pmu_del()
Rebuild or update PowerPC kernels on affected fleets and validate on non-production hosts before broad rollout
Restrict access to perf event creation for untrusted users by tightening kernel.perf_event_paranoid where operationally acceptable

Patch Information

The fix is distributed across multiple Linux stable branches. Relevant commits include 5397142d60aa, 67aeb1eb93d4, 73711688479d, 81e3a8603046, 9a515e00b001, b504fd953664, b89477077c83, and c0c7722308c5. Consult the appropriate stable branch matching your kernel version.

Workarounds

Raise kernel.perf_event_paranoid to 2 or higher to limit unprivileged access to hardware performance counters
Where feasible for the workload, deploy a kernel built without CONFIG_PREEMPT=y until patches are applied
Restrict use of profiling tools such as perf on production PowerPC systems to authorized administrators

bash

# Configuration example: tighten perf_event access pending patch deployment
sysctl -w kernel.perf_event_paranoid=3
echo "kernel.perf_event_paranoid = 3" >> /etc/sysctl.d/99-perf-hardening.conf