powerpc/hv-gpci: fix preempt count leak in sysfs show paths (CVE-2026-64070) | HOL Guard CVE

Unknown severity · Source severity not reportedCVE-2026-64070

powerpc/hv-gpci: fix preempt count leak in sysfs show paths

Answer in brief

CVE-2026-64070 records a Unknown severity vulnerability in powerpc/hv-gpci: fix preempt count leak in sysfs show paths. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Jul 19, 2026Updated Sep 2, 2026Source checked Sep 2, 2026First seen by HOL Sep 2, 2026Material review Sep 2, 2026

Upstream Advisory

Key facts

Risk: Unknown severitySource severity not reported
Exploitation: Not marked as known exploited
Affected software: 2 mapped packages or products
Fix availability: Available

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Linux/Linuxgeneric	>=71f1c39647d8c9d4d54a861ec81f1ff17544bcb6 <b300312562fd6e4729697adb9f777f00ca0429f3 \|\| >=71f1c39647d8c9d4d54a861ec81f1ff17544bcb6 <45afabe7f99c5d8746434ee41c86584c01d70147 \|\| >=71f1c39647d8c9d4d54a861ec81f1ff17544bcb6 <b61ebb2826ca1852c2bbd92a676fb622c358cab4 \|\| >=71f1c39647d8c9d4d54a861ec81f1ff17544bcb6 <903409000a07ac8e31ffedeb8516f4f8d67150c8 \|\| >=71f1c39647d8c9d4d54a861ec81f1ff17544bcb6 <dbc30a57bd8e026995e9fa8e8c31cffd18542c01	b300312562fd6e4729697adb9f777f00ca0429f3, 45afabe7f99c5d8746434ee41c86584c01d70147, b61ebb2826ca1852c2bbd92a676fb622c358cab4, 903409000a07ac8e31ffedeb8516f4f8d67150c8, dbc30a57bd8e026995e9fa8e8c31cffd18542c01
Linux/Linuxgeneric	6.6	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for Linux/Linux, Linux/Linux.
Review the reported fix. Update Linux/Linux to b300312562fd6e4729697adb9f777f00ca0429f3 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Jul 19, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 2, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Sep 2, 2026

Sources and claim methodology

Upstream source description

In the Linux kernel, the following vulnerability has been resolved: powerpc/hv-gpci: fix preempt count leak in sysfs show paths Four sysfs show() callbacks in hv-gpci take get_cpu_var(hv_gpci_reqb) (which calls preempt_disable()) but only call the matching put_cpu_var() on the error path under the 'out:' label. Every successful read leaks one preempt_disable(): processor_bus_topology_show() processor_config_show() affinity_domain_via_virtual_processor_show() affinity_domain_via_domain_show() (affinity_domain_via_partition_show() was already correct.) On a CONFIG_PREEMPT=y kernel, repeated reads raise preempt_count and eventually return to userspace with preemption still disabled. The next user-mode page fault then hits faulthandler_disabled() == 1, gets forced to SIGSEGV, and the resulting coredump trips 'BUG: scheduling while atomic' in call_usermodehelper_exec -> wait_for_completion_state -> schedule: BUG: scheduling while atomic: <task>/<pid>/0x00000004 ... __schedule_bug+0x6c/0x90 __schedule+0x58c/0x13a0 schedule+0x48/0x1a0 schedule_timeout+0x104/0x170 wait_for_completion_state+0x16c/0x330 call_usermodehelper_exec+0x254/0x2d0 vfs_coredump+0x1050/0x2590 get_signal+0xb9c/0xc80 do_notify_resume+0xf8/0x470 Add an out_success label that calls put_cpu_var() before returning the byte count, mirroring affinity_domain_via_partition_show().

Quoted source text, attributed separately from HOL analysis.