Cloudanix VulnDB

CVE-2026-98396

None

CVSS

—

EPSS

0.2%

Published

Oct 14, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A timing error in how the kernel protects memory on certain PowerPC systems can briefly allow unauthorized access between the kernel and user programs, potentially leading to instability or exposure until corrected by an update.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Authorization Bypass
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The flaw causes premature restoration of user AMR values via kuap_user_restore() in arch_exit_to_user_mode_prepare(), allowing kernel code to run with user memory access enabled too early in exception and syscall exit paths on PowerPC before platform-specific routines complete.

Why it matters to the business

PowerPC Linux systems may experience kernel warnings, instability during context switches, or unintended user memory access windows that weaken memory protection boundaries and increase crash or data exposure risk in production workloads.

How an attack unfolds

An attacker triggers exception or syscall return paths that invoke the early restore hook; this leaves KUAP unblocked while kernel code still executes, potentially allowing subsequent memory operations to bypass intended user/kernel isolation before the correct later restore in interrupt_exit_user_prepare or equivalent.

How to fix it

Update to a kernel containing the fix that removes the kuap_user_restore call from arch_exit_to_user_mode_prepare so that restoration occurs only in the final platform-specific exit routines immediately before RFI.

How to confirm the fix worked

Confirm the patch is applied by inspecting arch/powerpc/kernel or exceptions-64s.S and interrupt_64.S to ensure kuap_user_restore is no longer called from arch_exit_to_user_mode_prepare; enable CONFIG_PPC_KUAP_DEBUG and verify absence of the reported warning on exit paths.

Typical attack path

  1. Trigger exception or syscall that enters user return path
  2. Execute arch_exit_to_user_mode_prepare which calls kuap_user_restore early
  3. Kernel continues executing with user AMR active during irqentry_exit or syscall_exit_to_user_mode
  4. Exploit resulting window for unauthorized memory read/write before final RFI

How to detect it

Search kernel logs for the exact warning string from kup.h during interrupt_exit_user_prepare or similar exit paths; inspect stack traces containing arch_exit_to_user_mode_prepare combined with RFI return sequences.

What your security team should do

  • Prioritize patching PowerPC kernels to the fixed version within standard maintenance windows
  • Monitor for CONFIG_PPC_KUAP_DEBUG warnings in production logs as an exposure indicator
  • Review downstream distributions for backported fixes given the architecture-specific nature

The record

In the Linux kernel, the following vulnerability has been resolved: powerpc: Do not restore KUAP in arch_exit_to_user_mode_prepare() KUAP means kernel cannot touch user memory unless it explicitly is enabled. In the kernel it should stay AMR_KUAP_BLOCKED. While returning to userspace just before RFI, kernel should restore the user AMR value back. Looks like GENERIC_ENTRY might be treating arch_exit_to_user_mode_prepare() as the last architecture step before returning to userspace. commit bee25f97ad24 ("powerpc: Enable GENERIC_ENTRY feature") therefore called kuap_user_restore() from that hook. But on PowerPC that is too early. After irqentry_exit() / syscall_exit_to_user_mode() we still run platform specific exit routines. e.g. code snippets showing both exception handling and system call handling as the callers of function arch_exit_to_user_mode_prepare() which does kuap_user_restore(). The below path shows that calling kuap_user_restore() is too early when called from arch_exit_to_user_mode_prepare(). Exception handling in exceptions-64s.S ======================================= bl CFUNC(do_page_fault) ..DEFINE_INTERRUPT_HANDLER_ASYNC(do_page_fault) arch_interrupt_async_enter_prepare(regs); state = irqentry_enter(regs); instrumentation_begin(); irq_enter_rcu(); handler(regs); nap_adjust_return(regs); irq_exit_rcu(); instrumentation_end(); arch_interrupt_async_exit_prepare(regs); irqentry_exit(regs, state); <<< too early irqentry_exit_to_user_mode() __exit_to_user_mode_prepare(regs, EXIT_TO_USER_MODE_WORK_IRQ); arch_exit_to_user_mode_prepare(regs, ti_work); <<< too early b interrupt_return_srr .. bl CFUNC(interrupt_exit_user_prepare) <<< already calls kuap_user_restore prep_irq_for_enabled_exit() retry can run kernel code with IRQs on. So only when that routine is fully finished is when the user KUAP should be fully restored which interrupt_exit_user_prepare() already takes care of before returning. Similarly for system call handling in interrupt_64.S ====================================================== bl CFUNC(system_call_exception) .Lsyscall_exit: addi r4,r1,STACK_INT_FRAME_REGS li r5,0 /* !scv */ bl CFUNC(syscall_exit_prepare) .. kuap_assert_locked(); syscall_exit_to_user_mode(regs); <<< too early syscall_exit_to_user_mode_prepare(regs); <<< too early kuap_user_restore(regs); <<< already calls syscall_exit_prepare(), which can enable IRQs, replay a pending interrupt, and only then rfi. Those functions already restore KUAP immediately before rfi. Note that if we restore the user AMR too early like in the current code as shown from the code snippets above, then we get the following warning when CONFIG_PPC_KUAP_DEBUG is enabled: WARNING: arch/powerpc/include/asm/book3s/64/kup.h:293 at interrupt_exit_user_prepare+0x1a0/0x1c0 Hardware name: IBM pSeries (emulated by qemu) POWER10 (architected) TRAP: 0700 LR: c00000000000d8d4 CTR: c0000000021fe500 MSR: <SF,EE,ME,IR,DR,RI,LE> CR: 44000804 XER: 20040000 interrupt_exit_user_prepare+0x1a0/0x1c0 interrupt_return_srr_user+0x8/0x12c

Affected packages

Ecosystem Package Introduced Fixed