CVE-2026-93260powerpc/xive: propagate IPI init errors to prevent use-after-free
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: powerpc/xive: propagate IPI init errors to prevent use-after-free When xive_init_ipis() fails (e.g. irq_domain_alloc_irqs() fails), the error path frees the global xive_ipis array. However, xive_smp_probe() previously ignored this failure and proceeded to call xive_setup_cpu_ipi(), which dereferences the already-freed xive_ipis pointer -- a use-after-free. Now that xive_smp_probe() returns int (previous patch), propagate the error from xive_init_ipis() and xive_setup_cpu_ipi() through xive_smp_probe(). Check the return value in both pnv_smp_probe() and pSeries_smp_probe() so that IPI setup is aborted cleanly on failure, avoiding the use-after-free.
- CVSS
- 7.4 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 243e25112d06b348f087a6f7aba4bbc288285bdd builds before 5c9ab0c9cede9f149733d330e2d7d45341b71359; from 243e25112d06b348f087a6f7aba4bbc288285bdd before c554a8d376d5aea1b237ed6bef6f9fbfc550e67f; from 243e25112d06b348f087a6f7aba4bbc288285bdd before 411a3c016e7a95f5fa105a0587e07d0647a77727 | CNA record |
References
- https://git.kernel.org/stable/c/5c9ab0c9cede9f149733d330e2d7d45341b71359
- https://git.kernel.org/stable/c/c554a8d376d5aea1b237ed6bef6f9fbfc550e67f
- https://git.kernel.org/stable/c/411a3c016e7a95f5fa105a0587e07d0647a77727
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.