Cloudanix VulnDB

CVE-2026-23128

Medium · 5.5

CVSS

5.5

EPSS

0.2%

Published

Feb 14, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

On some ARM64 computers running Linux, waking the system from hibernation can cause an unexpected crash that stops normal operation.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The arm64 hibernation resume path in swsusp_arch_resume() performs a CFI hash check when invoking a copy of swsusp_arch_suspend_exit() that was intentionally marked SYM_CODE_* and therefore lacks a hash; the mismatch triggers a level-3 translation fault and kernel oops during resume from hibernate.

Why it matters to the business

ARM64 Linux systems that rely on hibernation may suffer unrecoverable resume failures, causing extended downtime, potential loss of unsaved work, and requiring manual intervention or reboot on affected devices such as certain Android platforms.

How an attack unfolds

An attacker with the ability to initiate a hibernate/resume cycle on a vulnerable kernel (for example via local privileges or a crafted init script) triggers the CFI verification inside swsusp_arch_resume, producing the paging fault and crash; the bug is not known to be leveraged for code execution or privilege escalation by any named threat actors.

How to fix it

Update the Linux kernel to a version containing commit 122b7cb80f7d468fcc2d18cf7eb320f09f310a96 or later; rebuild with the __nocfi annotation applied to swsusp_arch_resume and verify the hibernate_exit.text section layout remains unchanged.

How to confirm the fix worked

Confirm the running kernel contains commit 122b7cb80f7d468fcc2d18cf7eb320f09f310a96, attempt a hibernate/resume cycle on an arm64 device, and verify that no DABT oops referencing swsusp_arch_resume appears in the kernel log.

Typical attack path

  1. Obtain local access or trigger hibernation via legitimate user action or script
  2. Initiate system suspend-to-disk
  3. Trigger resume from the hibernate image
  4. swsusp_arch_resume executes the CFI check on the unmarked function
  5. Kernel data abort occurs, system oops and fails to complete resume

How to detect it

Search kernel logs and dmesg for the exact oops signature containing ESR 0x0000000096000007, the call trace ending in swsusp_arch_resume, and the message 'user address but active_mm is swapper' during early boot or resume; correlate with timestamps around software_resume_initcall.

  • Unable to handle kernel paging request at virtual address 0000000109170ffc
  • ESR = 0x0000000096000007
  • swsusp_arch_resume+0x2ac/0x344
  • Internal error: Oops: 0000000096000007
  • user address but active_mm is swapper

What your security team should do

  • Prioritize kernel updates containing the referenced commit on all arm64 production systems that support hibernation
  • Temporarily disable hibernation where the update cannot be applied quickly
  • Add the hibernation resume oops pattern to kernel log monitoring rules
  • Test the fixed kernel in a staging environment before broad deployment

The record

In the Linux kernel, the following vulnerability has been resolved: arm64: Set __nocfi on swsusp_arch_resume() A DABT is reported[1] on an android based system when resume from hiberate. This happens because swsusp_arch_suspend_exit() is marked with SYM_CODE_*() and does not have a CFI hash, but swsusp_arch_resume() will attempt to verify the CFI hash when calling a copy of swsusp_arch_suspend_exit(). Given that there's an existing requirement that the entrypoint to swsusp_arch_suspend_exit() is the first byte of the .hibernate_exit.text section, we cannot fix this by marking swsusp_arch_suspend_exit() with SYM_FUNC_*(). The simplest fix for now is to disable the CFI check in swsusp_arch_resume(). Mark swsusp_arch_resume() as __nocfi to disable the CFI check. [1] [ 22.991934][ T1] Unable to handle kernel paging request at virtual address 0000000109170ffc [ 22.991934][ T1] Mem abort info: [ 22.991934][ T1] ESR = 0x0000000096000007 [ 22.991934][ T1] EC = 0x25: DABT (current EL), IL = 32 bits [ 22.991934][ T1] SET = 0, FnV = 0 [ 22.991934][ T1] EA = 0, S1PTW = 0 [ 22.991934][ T1] FSC = 0x07: level 3 translation fault [ 22.991934][ T1] Data abort info: [ 22.991934][ T1] ISV = 0, ISS = 0x00000007, ISS2 = 0x00000000 [ 22.991934][ T1] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 22.991934][ T1] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 22.991934][ T1] [0000000109170ffc] user address but active_mm is swapper [ 22.991934][ T1] Internal error: Oops: 0000000096000007 [#1] PREEMPT SMP [ 22.991934][ T1] Dumping ftrace buffer: [ 22.991934][ T1] (ftrace buffer empty) [ 22.991934][ T1] Modules linked in: [ 22.991934][ T1] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.6.98-android15-8-g0b1d2aee7fc3-dirty-4k #1 688c7060a825a3ac418fe53881730b355915a419 [ 22.991934][ T1] Hardware name: Unisoc UMS9360-base Board (DT) [ 22.991934][ T1] pstate: 804000c5 (Nzcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 22.991934][ T1] pc : swsusp_arch_resume+0x2ac/0x344 [ 22.991934][ T1] lr : swsusp_arch_resume+0x294/0x344 [ 22.991934][ T1] sp : ffffffc08006b960 [ 22.991934][ T1] x29: ffffffc08006b9c0 x28: 0000000000000000 x27: 0000000000000000 [ 22.991934][ T1] x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000820 [ 22.991934][ T1] x23: ffffffd0817e3000 x22: ffffffd0817e3000 x21: 0000000000000000 [ 22.991934][ T1] x20: ffffff8089171000 x19: ffffffd08252c8c8 x18: ffffffc080061058 [ 22.991934][ T1] x17: 00000000529c6ef0 x16: 00000000529c6ef0 x15: 0000000000000004 [ 22.991934][ T1] x14: ffffff8178c88000 x13: 0000000000000006 x12: 0000000000000000 [ 22.991934][ T1] x11: 0000000000000015 x10: 0000000000000001 x9 : ffffffd082533000 [ 22.991934][ T1] x8 : 0000000109171000 x7 : 205b5d3433393139 x6 : 392e32322020205b [ 22.991934][ T1] x5 : 000000010916f000 x4 : 000000008164b000 x3 : ffffff808a4e0530 [ 22.991934][ T1] x2 : ffffffd08058e784 x1 : 0000000082326000 x0 : 000000010a283000 [ 22.991934][ T1] Call trace: [ 22.991934][ T1] swsusp_arch_resume+0x2ac/0x344 [ 22.991934][ T1] hibernation_restore+0x158/0x18c [ 22.991934][ T1] load_image_and_restore+0xb0/0xec [ 22.991934][ T1] software_resume+0xf4/0x19c [ 22.991934][ T1] software_resume_initcall+0x34/0x78 [ 22.991934][ T1] do_one_initcall+0xe8/0x370 [ 22.991934][ T1] do_initcall_level+0xc8/0x19c [ 22.991934][ T1] do_initcalls+0x70/0xc0 [ 22.991934][ T1] do_basic_setup+0x1c/0x28 [ 22.991934][ T1] kernel_init_freeable+0xe0/0x148 [ 22.991934][ T1] kernel_init+0x20/0x1a8 [ 22.991934][ T1] ret_from_fork+0x10/0x20 [ 22.991934][ T1] Code: a9400a61 f94013e0 f9438923 f9400a64 (b85fc110) [catalin.marinas@arm.com: commit log updated by Mark Rutland]

Affected packages

Ecosystem Package Introduced Fixed
Linux Kernel 6.1.0 6.1.162
openSUSE:Leap 16.0 dtb-aarch64 0 6.12.0-160000.27.1
openSUSE:Leap 16.0 kernel-64kb 0 6.12.0-160000.27.1
openSUSE:Leap 16.0 kernel-azure 0 6.12.0-160000.27.1
openSUSE:Leap 16.0 kernel-default 0 6.12.0-160000.27.1
openSUSE:Leap 16.0 kernel-default-base 0 6.12.0-160000.27.1.160000.2.8
openSUSE:Leap 16.0 kernel-docs 0 6.12.0-160000.27.1
openSUSE:Leap 16.0 kernel-kvmsmall 0 6.12.0-160000.27.1
openSUSE:Leap 16.0 kernel-obs-build 0 6.12.0-160000.27.1
openSUSE:Leap 16.0 kernel-obs-qa 0 6.12.0-160000.27.1
openSUSE:Leap 16.0 kernel-rt 0 6.12.0-160000.27.1
openSUSE:Leap 16.0 kernel-source 0 6.12.0-160000.27.1
openSUSE:Leap 16.0 kernel-syms 0 6.12.0-160000.27.1
openSUSE:Leap 16.0 kernel-zfcpdump 0 6.12.0-160000.27.1

Related vulnerabilities