HIGH Introduced in 4.12
xive IpiInit UAF
CVE-2026-93260
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.3HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: powerpc/xive: propagate IPI init errors to prevent use-after-free When xive_init_ipis() fails (e.g. irq_domain_alloc_irqs() fails), the error path frees the global xive_ipis array. However, xive_smp_probe() previously ignored this failure and proceeded to call xive_setup_cpu_ipi(), which dereferences the already-freed xive_ipis pointer -- a use-after-free. Now that xive_smp_probe() returns int (previous patch), propagate the error from xive_init_ipis() and xive_setup_cpu_ipi() through xive_smp_probe(). Check the return value in both pnv_smp_probe() and pSeries_smp_probe() so that IPI setup is aborted cleanly on failure, avoiding the use-after-free.
02KernelScan AI Analysis
Risk summary
A use-after-free in the PowerPC XIVE interrupt controller initialization can occur when IPI allocation fails during boot. The freed IPI array is subsequently dereferenced, potentially leading to memory corruption or a kernel crash. This affects PowerPC systems (POWER9 and later) with XIVE enabled, both bare-metal (powernv) and virtualized (pSeries).
Vulnerability analysis
During boot on PowerPC systems using the XIVE interrupt controller, if the inter-processor interrupt allocation fails, the error cleanup path frees the IPI array, but the SMP probe function ignores this failure and continues to dereference the freed pointer — a use-after-free that can corrupt memory or crash the kernel. The fix makes the initialization functions check and propagate allocation errors so the platform probe aborts IPI setup cleanly instead of proceeding with a freed pointer. This code path runs only during early boot on PowerPC hardware (POWER9 and later) with XIVE enabled and is triggered by an allocation failure under resource pressure rather than by direct user action.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| mainline | 4.12 | 7.3-rc1 | 411a3c016e7a |
| 7.2 | 4.12 | 7.2.6 | c554a8d376d5 |