CVE-2026-98917

What it actually does

Insufficient kernel stack allocation (THREAD_SIZE_ORDER) on 64-bit parisc allows stack overflows under load, triggering panics when the stack pointer exceeds allocated bounds during IRQ handling or workqueue execution.

Why it matters to the business

Systems may experience sudden kernel crashes during demanding compilation or I/O workloads, leading to downtime, lost work, and requiring reboots on affected hardware.

How an attack unfolds

An attacker or workload triggers deep kernel call chains or recursive operations that exhaust the limited stack; the overflow is detected by stack checking in the IRQ handler, resulting in a panic rather than controlled exploitation.

How to fix it

Update to a kernel that increases THREAD_SIZE_ORDER to allocate 32 kB stacks for 64-bit parisc; rebuild and deploy the fixed kernel image on all affected systems.

How to confirm the fix worked

Boot the updated kernel and confirm THREAD_SIZE_ORDER reflects 32 kB allocation; monitor for absence of stackcheck panics under equivalent workloads that previously triggered the issue.

Typical attack path

1. Identify parisc 64-bit system running vulnerable kernel
2. Trigger high-stack-usage operations such as package builds or writeback workqueues
3. Cause stack pointer to exceed THREAD_SIZE boundary
4. Induce kernel panic via stackcheck in IRQ context

How to detect it

Search kernel logs for stackcheck warnings, low stack detected messages, and panics referencing do_cpu_irq_mask or vpanic on parisc hardware; correlate with high-stack-usage processes such as kworker or gcc invocations.

What your security team should do

• Prioritize patching parisc 64-bit systems within the next maintenance window
• Test the updated kernel under representative build and I/O loads before broad deployment
• Review kernel configuration for any custom stack size settings that may conflict with the fix