CVE-2026-93260

powerpc/xive: propagate IPI init errors to prevent use-after-free

State: Published
Severity: 7.4 High
Published: Sep 24, 2026
Updated: Oct 30, 2026
Reserved: Sep 17, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

powerpc/xive: propagate IPI init errors to prevent use-after-free

When xive_init_ipis() fails (e.g. irq_domain_alloc_irqs() fails), the error path frees the global xive_ipis array. However, xive_smp_probe() previously ignored this failure and proceeded to call xive_setup_cpu_ipi(), which dereferences the already-freed xive_ipis pointer -- a use-after-free.

Now that xive_smp_probe() returns int (previous patch), propagate the error from xive_init_ipis() and xive_setup_cpu_ipi() through xive_smp_probe(). Check the return value in both pnv_smp_probe() and pSeries_smp_probe() so that IPI setup is aborted cleanly on failure, avoiding the use-after-free.

Scores

CVSS	Score	Vector	Source
3.1	7.4 High	CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	243e25112d06b348f087a6f7aba4bbc288285bdd to before 89e1caa5b0aafe23e9938d9a311e9d41baee583eAffected 243e25112d06b348f087a6f7aba4bbc288285bdd to before e36b1c2eafcaaddefa70d55e6fda74cf6cda38afAffected 243e25112d06b348f087a6f7aba4bbc288285bdd to before 2ea6238343691309e68308131c7e80c3ae05afeaAffected 243e25112d06b348f087a6f7aba4bbc288285bdd to before 5c9ab0c9cede9f149733d330e2d7d45341b71359Affected 243e25112d06b348f087a6f7aba4bbc288285bdd to before c554a8d376d5aea1b237ed6bef6f9fbfc550e67fAffected 243e25112d06b348f087a6f7aba4bbc288285bdd to before 411a3c016e7a95f5fa105a0587e07d0647a77727Affected
LinuxLinux	4.12Affected before 4.12Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.114 through 6.12.Not affected 6.18.57 through 6.18.Not affected 7.2.6 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

243e25112d06b348f087a6f7aba4bbc288285bdd to before 89e1caa5b0aafe23e9938d9a311e9d41baee583eAffected
243e25112d06b348f087a6f7aba4bbc288285bdd to before e36b1c2eafcaaddefa70d55e6fda74cf6cda38afAffected
243e25112d06b348f087a6f7aba4bbc288285bdd to before 2ea6238343691309e68308131c7e80c3ae05afeaAffected
243e25112d06b348f087a6f7aba4bbc288285bdd to before 5c9ab0c9cede9f149733d330e2d7d45341b71359Affected
243e25112d06b348f087a6f7aba4bbc288285bdd to before c554a8d376d5aea1b237ed6bef6f9fbfc550e67fAffected
243e25112d06b348f087a6f7aba4bbc288285bdd to before 411a3c016e7a95f5fa105a0587e07d0647a77727Affected

LinuxLinux

4.12Affected
before 4.12Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.114 through 6.12.*Not affected
6.18.57 through 6.18.*Not affected
7.2.6 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.