Cloudanix VulnDB

CVE-2026-98888

None

CVSS

—

EPSS

0.2%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in Linux on certain processors could make the system unstable when advanced debugging tools are active.

Exploitation
Local Privilege
Attacker needs
High Privilege
Complexity
High
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

In arm64 Linux kernel kprobes, a hit during KPROBE_HIT_SS state was incorrectly treated as unrecoverable like KPROBE_REENTER, and saved_irqflag was not preserved across reentry, allowing overwrite that leaves interrupts permanently disabled after outer probe single-step completes.

Why it matters to the business

On arm64 systems, debugging and performance tools using kprobes could trigger kernel instability or hangs within days of exposure; low EPSS and no KEV listing indicate limited immediate operational risk but still requires prompt attention given two-day-old disclosure.

How an attack unfolds

An attacker with ability to install kprobes (via perf or tracing) triggers a nested probe while one is single-stepping; the missing saved_irqflag preservation causes incorrect DAIF mask restoration, disabling interrupts permanently after the outer probe finishes.

How to fix it

Update to a Linux kernel containing the referenced arm64 kprobes reentry fix that moves KPROBE_HIT_SS to recoverable cases and extends struct prev_kprobe with saved_irqflag; rebuild and reboot arm64 systems.

How to confirm the fix worked

Confirm kernel source includes the commit extending prev_kprobe and handling KPROBE_HIT_SS as recoverable; run kprobe stress tests exercising nested single-step reentry and verify interrupts remain enabled.

Typical attack path

  1. Install kprobe on arm64 target via perf or eBPF tracing
  2. Trigger first probe to enter KPROBE_HIT_SS state
  3. Force nested probe hit from debug exception path
  4. Observe failure to restore original interrupt flags

How to detect it

Examine kernel logs for kprobe reentry warnings or unexpected interrupt state changes; review perf or tracing sessions that coincide with system hangs on arm64.

What your security team should do

  • Prioritize arm64 kernel updates within normal patching windows given low EPSS and no known exploitation
  • Audit systems using perf or kprobes for tracing to ensure they run patched kernels
  • Monitor upstream stable branches for backports of the kprobes fix

The record

In the Linux kernel, the following vulnerability has been resolved: arm64: kprobes: Allow reentering kprobes while single-stepping A kprobe can be hit while another kprobe is in KPROBE_HIT_SS state. This can happen when tracing or perf code runs from the debug exception path while the first kprobe is preparing or executing its out-of-line single-step instruction. Currently arm64 treats a kprobe hit in KPROBE_HIT_SS as unrecoverable, the same as a hit in KPROBE_REENTER. This is too strict. A hit in KPROBE_HIT_SS is still a one-level reentry and can be handled by saving the current kprobe state and setting up single-step for the new probe, just like reentry from KPROBE_HIT_ACTIVE or KPROBE_HIT_SSDONE. The truly unrecoverable case is hitting another kprobe while already in KPROBE_REENTER, because the reentry save area has already been consumed. Move KPROBE_HIT_SS to the recoverable reentry cases and leave KPROBE_REENTER as the unrecoverable nested reentry case. This change also requires saving saved_irqflag in struct prev_kprobe. When a nested kprobe calls kprobes_save_local_irqflag(), it overwrites kcb->saved_irqflag with the currently masked DAIF value, losing the outer kprobe's original DAIF state. Without this fix, when the outer kprobe's single-step finishes, kprobes_restore_local_irqflag() applies the wrong DAIF mask and leaves interrupts permanently disabled. Extend struct prev_kprobe with a saved_irqflag field and save/restore it alongside kp and status. This ensures the outer kprobe's original interrupt state is preserved across reentry. This mirrors the x86 fix in commit 6a5022a56ac3 ("kprobes/x86: Allow to handle reentered kprobe on single-stepping").

Affected packages

Ecosystem Package Introduced Fixed