{"id":"CVE-2026-93260","state":"PUBLISHED","title":"powerpc/xive: propagate IPI init errors to prevent use-after-free","description":"In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/xive: propagate IPI init errors to prevent use-after-free\n\nWhen xive_init_ipis() fails (e.g. irq_domain_alloc_irqs() fails),\nthe error path frees the global xive_ipis array.  However,\nxive_smp_probe() previously ignored this failure and proceeded to\ncall xive_setup_cpu_ipi(), which dereferences the already-freed\nxive_ipis pointer -- a use-after-free.\n\nNow that xive_smp_probe() returns int (previous patch), propagate\nthe error from xive_init_ipis() and xive_setup_cpu_ipi() through\nxive_smp_probe().  Check the return value in both pnv_smp_probe()\nand pSeries_smp_probe() so that IPI setup is aborted cleanly on\nfailure, avoiding the use-after-free.","publishedAt":"2026-09-24T15:51:46.703Z","updatedAt":"2026-10-30T12:36:35.383Z","severity":{"score":7.4,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"243e25112d06b348f087a6f7aba4bbc288285bdd","status":"affected","lessThan":"89e1caa5b0aafe23e9938d9a311e9d41baee583e","versionType":"git"},{"version":"243e25112d06b348f087a6f7aba4bbc288285bdd","status":"affected","lessThan":"e36b1c2eafcaaddefa70d55e6fda74cf6cda38af","versionType":"git"},{"version":"243e25112d06b348f087a6f7aba4bbc288285bdd","status":"affected","lessThan":"2ea6238343691309e68308131c7e80c3ae05afea","versionType":"git"},{"version":"243e25112d06b348f087a6f7aba4bbc288285bdd","status":"affected","lessThan":"5c9ab0c9cede9f149733d330e2d7d45341b71359","versionType":"git"},{"version":"243e25112d06b348f087a6f7aba4bbc288285bdd","status":"affected","lessThan":"c554a8d376d5aea1b237ed6bef6f9fbfc550e67f","versionType":"git"},{"version":"243e25112d06b348f087a6f7aba4bbc288285bdd","status":"affected","lessThan":"411a3c016e7a95f5fa105a0587e07d0647a77727","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/powerpc/platforms/powernv/smp.c","arch/powerpc/platforms/pseries/smp.c","arch/powerpc/sysdev/xive/common.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.12","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.12","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.114","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.57","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.6","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/powerpc/platforms/powernv/smp.c","arch/powerpc/platforms/pseries/smp.c","arch/powerpc/sysdev/xive/common.c"]}],"references":["https://git.kernel.org/stable/c/89e1caa5b0aafe23e9938d9a311e9d41baee583e","https://git.kernel.org/stable/c/e36b1c2eafcaaddefa70d55e6fda74cf6cda38af","https://git.kernel.org/stable/c/2ea6238343691309e68308131c7e80c3ae05afea","https://git.kernel.org/stable/c/5c9ab0c9cede9f149733d330e2d7d45341b71359","https://git.kernel.org/stable/c/c554a8d376d5aea1b237ed6bef6f9fbfc550e67f","https://git.kernel.org/stable/c/411a3c016e7a95f5fa105a0587e07d0647a77727"],"weaknesses":[],"ingestedAt":"2026-10-30T12:56:04.490Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/93xxx/CVE-2026-93260.json","commit":"1f312381e38164a43607eebab851b151dd16861e","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-93260","state":"PUBLISHED","datePublished":"2026-09-24T15:51:46.703Z","dateUpdated":"2026-10-30T12:36:35.383Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-09-17T16:02:15.097Z"},"containers":{"cna":{"title":"powerpc/xive: propagate IPI init errors to prevent use-after-free","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/xive: propagate IPI init errors to prevent use-after-free\n\nWhen xive_init_ipis() fails (e.g. irq_domain_alloc_irqs() fails),\nthe error path frees the global xive_ipis array.  However,\nxive_smp_probe() previously ignored this failure and proceeded to\ncall xive_setup_cpu_ipi(), which dereferences the already-freed\nxive_ipis pointer -- a use-after-free.\n\nNow that xive_smp_probe() returns int (previous patch), propagate\nthe error from xive_init_ipis() and xive_setup_cpu_ipi() through\nxive_smp_probe().  Check the return value in both pnv_smp_probe()\nand pSeries_smp_probe() so that IPI setup is aborted cleanly on\nfailure, avoiding the use-after-free."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"243e25112d06b348f087a6f7aba4bbc288285bdd","status":"affected","lessThan":"89e1caa5b0aafe23e9938d9a311e9d41baee583e","versionType":"git"},{"version":"243e25112d06b348f087a6f7aba4bbc288285bdd","status":"affected","lessThan":"e36b1c2eafcaaddefa70d55e6fda74cf6cda38af","versionType":"git"},{"version":"243e25112d06b348f087a6f7aba4bbc288285bdd","status":"affected","lessThan":"2ea6238343691309e68308131c7e80c3ae05afea","versionType":"git"},{"version":"243e25112d06b348f087a6f7aba4bbc288285bdd","status":"affected","lessThan":"5c9ab0c9cede9f149733d330e2d7d45341b71359","versionType":"git"},{"version":"243e25112d06b348f087a6f7aba4bbc288285bdd","status":"affected","lessThan":"c554a8d376d5aea1b237ed6bef6f9fbfc550e67f","versionType":"git"},{"version":"243e25112d06b348f087a6f7aba4bbc288285bdd","status":"affected","lessThan":"411a3c016e7a95f5fa105a0587e07d0647a77727","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/powerpc/platforms/powernv/smp.c","arch/powerpc/platforms/pseries/smp.c","arch/powerpc/sysdev/xive/common.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.12","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.12","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.114","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.57","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.6","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/powerpc/platforms/powernv/smp.c","arch/powerpc/platforms/pseries/smp.c","arch/powerpc/sysdev/xive/common.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/89e1caa5b0aafe23e9938d9a311e9d41baee583e"},{"url":"https://git.kernel.org/stable/c/e36b1c2eafcaaddefa70d55e6fda74cf6cda38af"},{"url":"https://git.kernel.org/stable/c/2ea6238343691309e68308131c7e80c3ae05afea"},{"url":"https://git.kernel.org/stable/c/5c9ab0c9cede9f149733d330e2d7d45341b71359"},{"url":"https://git.kernel.org/stable/c/c554a8d376d5aea1b237ed6bef6f9fbfc550e67f"},{"url":"https://git.kernel.org/stable/c/411a3c016e7a95f5fa105a0587e07d0647a77727"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":7.4,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The UAF is in xive_setup_cpu_ipi() after xive_init_ipis() kfree's xive_ipis, reached only from kernel_init_freeable()->smp_prepare_cpus()->pnv_smp_probe()/pSeries_smp_probe()->xive_smp_probe(); no protocol message or received packet supplies the trigger.\nAC:H - The free-then-use fires only when irq_domain_alloc_irqs() fails in xive_init_ipis()'s for_each_node loop (irq_desc ENOMEM/ENOSPC), after which kfree(xive_ipis) runs; that allocator failure during early SMP probe cannot be induced on demand.\nPR:N - xive_smp_probe() runs as swapper/0 from smp_prepare_cpus() in kernel_init_freeable() before userspace, with no capable() or credential check on pnv_smp_probe() or pSeries_smp_probe().\nUI:N - SMP IPI probe is invoked unconditionally by smp_prepare_cpus() during ordinary boot once xive_core_init() has set __xive_enabled; no victim mount, file open, or other interactive step is required.\nS:U - The dangling xive_ipis dereference corrupts heap in the same Linux instance that runs XIVE (PowerNV host or pSeries guest); it is not a KVM/Xen guest-to-host escape or an IOMMU/DMA boundary bypass.\nC:H - After kfree(xive_ipis) without NULLing, xive_ipi_cpu_to_irq() and xive_request_ipi() read xid->irq and xid->name from the freed xive_ipi_desc array; that heap use-after-free can disclose whatever reclaimed the slab.\nI:H - xive_request_ipi() then atomic_inc_return(&xid->started) on the freed descriptor and request_irq(xid->irq, xive_muxed_ipi_action) using the UAF-read virq, a write-after-free of the xive_ipi_desc slab that can corrupt a reused object and install a handler on the wrong irq.\nA:H - Dereferencing the kfree'd xive_ipis pointer in xive_setup_cpu_ipi() during xive_smp_probe() oopses or panics the kernel while bringing up SMP, so the machine fails to boot."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-30T12:36:35.383Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.12","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.12","versionEndExcluding":"6.6.160"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.12","versionEndExcluding":"6.12.114"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.12","versionEndExcluding":"6.18.57"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.12","versionEndExcluding":"7.2.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.12","versionEndExcluding":"7.3"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}