CVE-2026-64070

What it actually does

This is a Linux kernel denial-of-service flaw in the PowerPC hv-gpci sysfs read paths. Four sysfs show() callbacks call get_cpu_var(), which disables preemption, but on successful reads they return without calling put_cpu_var(), leaving the task's preemption count elevated. On CONFIG_PREEMPT=y kernels, repeated reads can cause a process to return to userspace with preemption still disabled; a later user-mode page fault may be forced into SIGSEGV and coredump handling can trigger kernel warnings such as “BUG: scheduling while atomic.” The practical impact is local kernel instability and denial of service on affected PowerPC systems exposing the hv-gpci sysfs interfaces.

Why it matters to the business

A local user or compromised low-privilege process may be able to destabilize affected PowerPC Linux systems by repeatedly reading specific kernel sysfs files, potentially causing service interruption, node instability, crash-handling failures, and operational downtime. The issue is not currently listed in CISA KEV, has very low EPSS, and no public exploit maturity was provided, so broad internet-scale exploitation is unlikely; however, systems that provide shared shell access, multi-tenant compute, or untrusted local workloads should treat it with higher priority.

How an attack unfolds

An attacker first obtains local code execution or shell access on an affected PowerPC Linux host with a preemptible kernel. They identify the hv-gpci sysfs interface and repeatedly read one of the affected attributes handled by processor_bus_topology_show(), processor_config_show(), affinity_domain_via_virtual_processor_show(), or affinity_domain_via_domain_show(). Each successful read leaks a preemption disable reference in the current task. After enough reads, the task returns to userspace with an invalid preemption state. When that task later triggers a user-mode page fault, the kernel treats fault handling as disabled, forces a SIGSEGV, and coredump handling can attempt to sleep while atomic, producing kernel errors and potentially destabilizing the system.

How to fix it

Upgrade to a Linux kernel version that includes the hv-gpci fix adding the missing put_cpu_var() call on successful sysfs reads. If distribution packages are used, apply the vendor kernel update rather than attempting to patch manually. No exact fixed package versions were provided in the input, so track the fix through the relevant Linux distribution, appliance vendor, or upstream stable kernel advisory. As interim mitigations, restrict local shell access, reduce untrusted workload execution on affected PowerPC hosts, limit access to hv-gpci sysfs files where operationally safe, and disable or avoid exposing the affected hv-gpci functionality if it is not required.

How to confirm the fix worked

Confirm the running kernel includes the patch for the PowerPC hv-gpci sysfs preempt count leak. Validate through vendor package metadata, kernel changelog entries, or source inspection showing successful paths in processor_bus_topology_show(), processor_config_show(), affinity_domain_via_virtual_processor_show(), and affinity_domain_via_domain_show() call put_cpu_var() before returning. On test systems only, repeated reads of the affected hv-gpci sysfs attributes should no longer produce increasing preemption-count side effects, forced SIGSEGV behavior, or kernel log messages such as “BUG: scheduling while atomic.” Production validation should rely on version verification and kernel log review rather than stress-triggering the bug.

Typical attack path

1. Gain local execution on an affected PowerPC Linux system, such as through shell access, a compromised service account, or an untrusted workload.
2. Locate readable hv-gpci sysfs attributes exposed by the kernel.
3. Repeatedly read one of the affected attributes tied to the vulnerable show() callbacks.
4. Accumulate leaked preempt_disable() state in the task by causing successful sysfs reads.
5. Trigger a user-mode page fault or wait for normal execution to hit one.
6. Cause SIGSEGV and coredump handling paths to run while the task is effectively atomic, resulting in kernel warnings, instability, or denial of service.

How to detect it

Look for evidence of local abuse or accidental triggering in kernel logs, audit logs, process accounting, and shell history. Primary evidence is kernel output showing “BUG: scheduling while atomic,” SIGSEGV/coredump activity, or stack traces involving call_usermodehelper_exec, vfs_coredump, get_signal, do_notify_resume, or hv-gpci. If auditd or eBPF file-access monitoring is enabled, search for high-frequency read/open events against hv-gpci sysfs paths or attributes associated with processor bus topology, processor config, or affinity domain queries. Correlate these events with a local user, container, batch job, or service process that subsequently crashed or generated a core dump. Because this is a local denial-of-service condition, network indicators are not expected.

• BUG: scheduling while atomic
• faulthandler_disabled
• call_usermodehelper_exec
• wait_for_completion_state
• vfs_coredump
• do_notify_resume
• processor_bus_topology_show
• processor_config_show
• affinity_domain_via_virtual_processor_show
• affinity_domain_via_domain_show
• hv-gpci
• hv_gpci_reqb
• /sys/devices/hv_gpci
• processor_bus_topology
• processor_config
• affinity_domain_via_virtual_processor
• affinity_domain_via_domain

What your security team should do

• Inventory PowerPC Linux systems, especially those running CONFIG_PREEMPT=y kernels and exposing hv-gpci sysfs interfaces.
• Apply vendor kernel updates containing the hv-gpci preempt count leak fix at the next maintenance window, or sooner for shared or multi-tenant systems.
• Prioritize systems that allow local users, batch jobs, containers, or untrusted workloads to read sysfs.
• Review kernel logs for signs of prior triggering, including scheduling-while-atomic warnings, coredump failures, and hv-gpci-related stack traces.
• Restrict unnecessary local access and sysfs visibility until patched.
• If affected systems are part of critical infrastructure, add temporary monitoring for repeated reads of hv-gpci sysfs attributes and unusual local process crashes.
• Track distribution advisories because exact fixed package versions were not provided.