CVE catalog

CVE-2026-98396

In the Linux kernel, the following vulnerability has…

In the Linux kernel, the following vulnerability has been resolved: powerpc: Do not restore KUAP in arch_exit_to_user_mode_prepare() KUAP means kernel cannot touch user memory unless it explicitly is enabled. In the kernel it should stay AMR_KUAP_BLOCKED. While returning to userspace just before RFI, kernel should restore the user AMR value back. Looks like GENERIC_ENTRY might be treating arch_exit_to_user_mode_prepare() as the last architecture step before returning to userspace. commit bee25f97ad24 ("powerpc: Enable GENERIC_ENTRY feature") therefore called kuap_user_restore() from that hook. But on PowerPC that is too early. After irqentry_exit() / syscall_exit_to_user_mode() we still run platform specific exit routines. e.g. code snippets showing both exception handling and system call handling as the callers of function arch_exit_to_user_mode_prepare() which does kuap_user_restore(). The below path shows that calling kuap_user_restore() is too early when called from arch_exit_to_user_mode_prepare(). Exception handling in exceptions-64s.S ======================================= bl CFUNC(do_page_fault) ..DEFINE_INTERRUPT_HANDLER_ASYNC(do_page_fault) arch_interrupt_async_enter_prepare(regs); state = irqentry_enter(regs); instrumentation_begin(); irq_enter_rcu(); handler(regs); nap_adjust_return(regs); irq_exit_rcu(); instrumentation_end(); arch_interrupt_async_exit_prepare(regs); irqentry_exit(regs, state); <<< too early irqentry_exit_to_user_mode() __exit_to_user_mode_prepare(regs, EXIT_TO_USER_MODE_WORK_IRQ); arch_exit_to_user_mode_prepare(regs, ti_work); <<< too early b interrupt_return_srr .. bl CFUNC(interrupt_exit_user_prepare) <<< already calls kuap_user_restore prep_irq_for_enabled_exit() retry can run kernel code with IRQs on. So only when that routine is fully finished is when the user KUAP should be fully restored which interrupt_exit_user_prepare() already takes care of before returning. Similarly for system call handling in interrupt_64.S ====================================================== bl CFUNC(system_call_exception) .Lsyscall_exit: addi r4,r1,STACK_INT_FRAME_REGS li r5,0 /* !scv */ bl CFUNC(syscall_exit_prepare) .. kuap_assert_locked(); syscall_exit_to_user_mode(regs); <<< too early syscall_exit_to_user_mode_prepare(regs); <<< too early kuap_user_restore(regs); <<< already calls syscall_exit_prepare(), which can enable IRQs, replay a pending interrupt, and only then rfi. Those functions already restore KUAP immediately before rfi. Note that if we restore the user AMR too early like in the current code as shown from the code snippets above, then we get the following warning when CONFIG_PPC_KUAP_DEBUG is enabled: WARNING: arch/powerpc/include/asm/book3s/64/kup.h:293 at interrupt_exit_user_prepare+0x1a0/0x1c0 Hardware name: IBM pSeries (emulated by qemu) POWER10 (architected) TRAP: 0700 LR: c00000000000d8d4 CTR: c0000000021fe500 MSR: <SF,EE,ME,IR,DR,RI,LE> CR: 44000804 XER: 20040000 interrupt_exit_user_prepare+0x1a0/0x1c0 interrupt_return_srr_user+0x8/0x12c

Severity: Medium · CVSS 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Published: Oct 14, 2026, 12:00:00 AM UTC
Updated: Oct 14, 2026, 2:17:50 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.20% · Oct 27, 2026

Projects and upstream resources

[linux][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Version impact has not been established. The original provider fields are retained below.

Provider details and historical evidence

Original provider fields

{
  "package_releases": [
    {
      "name": "linux",
      "status": "fixed",
      "release": "sid",
      "version": "7.2.13-1"
    },
    {
      "name": "linux",
      "status": "fixed",
      "release": "forky",
      "version": "7.2.12-1"
    },
    {
      "name": "linux",
      "status": "not affected",
      "release": "trixie",
      "version": "6.12.107-1"
    },
    {
      "name": "linux",
      "status": "not affected",
      "release": "trixie-security",
      "version": "6.12.113-1"
    },
    {
      "name": "linux",
      "status": "not affected",
      "release": "bookworm",
      "version": "6.1.176-1"
    },
    {
      "name": "linux",
      "status": "not affected",
      "release": "bookworm-security",
      "version": "6.1.190-1"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "linux",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "7.2.7-1"
    },
    {
      "bug": null,
      "name": "linux",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "7.2.7-1"
    },
    {
      "bug": null,
      "name": "linux",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "unimportant",
      "fixed_version": "0"
    },
    {
      "bug": null,
      "name": "linux",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "unimportant",
      "fixed_version": "0"
    }
  ],
  "distribution_packages": [
    {
      "name": "Kernel",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "7.2.0"
            },
            {
              "fixed": "7.2.7"
            }
          ]
        }
      ],
      "versions": [],
      "ecosystem": "Linux",
      "fixed_version": "7.2.7",
      "provider_record_id": "CVE-2026-98396"
    }
  ]
}

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[bpftool]Unknown
Source package: [linux]
Details (6)
- 7.1.0+6.1.176-1 · amd64 · bookworm
  Not affected
  nvd · linux · debian · bookworm
- 7.1.0+6.1.176-1 · arm64 · bookworm
  Not affected
  nvd · linux · debian · bookworm
- 7.5.0+6.12.95-1~bpo12+1 · amd64 · bookworm-backports
  Not affected
  nvd · linux · debian · bookworm
- 7.5.0+6.12.95-1~bpo12+1 · arm64 · bookworm-backports
  Not affected
  nvd · linux · debian · bookworm
- 7.1.0+6.1.180-1 · amd64 · bookworm-security
  Not affected
  nvd · linux · debian · bookworm
- 7.1.0+6.1.180-1 · arm64 · bookworm-security
  Not affected
  nvd · linux · debian · bookworm
[hyperv-daemons]Unknown
Source package: [linux]
Details (6)
- 6.1.176-1 · amd64 · bookworm
  Not affected
  nvd · linux · debian · bookworm
- 6.1.176-1 · arm64 · bookworm
  Not affected
  nvd · linux · debian · bookworm
- 6.12.95-1~bpo12+1 · amd64 · bookworm-backports
  Not affected
  nvd · linux · debian · bookworm
- 6.12.95-1~bpo12+1 · arm64 · bookworm-backports
  Not affected
  nvd · linux · debian · bookworm
- 6.1.180-1 · amd64 · bookworm-security
  Not affected
  nvd · linux · debian · bookworm
- 6.1.180-1 · arm64 · bookworm-security
  Not affected
  nvd · linux · debian · bookworm
[intel-sdsi]Unknown
Source package: [linux]
Details (1)
- 6.12.95-1~bpo12+1 · amd64 · bookworm-backports
  Not affected
  nvd · linux · debian · bookworm
[libcpupower1]Unknown
Source package: [linux]
Details (6)
- 6.1.176-1 · amd64 · bookworm
  Not affected
  nvd · linux · debian · bookworm
- 6.1.176-1 · arm64 · bookworm
  Not affected
  nvd · linux · debian · bookworm
- 6.12.95-1~bpo12+1 · amd64 · bookworm-backports
  Not affected
  nvd · linux · debian · bookworm
- 6.12.95-1~bpo12+1 · arm64 · bookworm-backports
  Not affected
  nvd · linux · debian · bookworm
- 6.1.180-1 · amd64 · bookworm-security
  Not affected
  nvd · linux · debian · bookworm
- 6.1.180-1 · arm64 · bookworm-security
  Not affected
  nvd · linux · debian · bookworm
[libcpupower-dev]Unknown
Source package: [linux]
Details (6)
- 6.1.176-1 · amd64 · bookworm
  Not affected
  nvd · linux · debian · bookworm
- 6.1.176-1 · arm64 · bookworm
  Not affected
  nvd · linux · debian · bookworm
- 6.12.95-1~bpo12+1 · amd64 · bookworm-backports
  Not affected
  nvd · linux · debian · bookworm
- 6.12.95-1~bpo12+1 · arm64 · bookworm-backports
  Not affected
  nvd · linux · debian · bookworm
- 6.1.180-1 · amd64 · bookworm-security
  Not affected
  nvd · linux · debian · bookworm
- 6.1.180-1 · arm64 · bookworm-security
  Not affected
  nvd · linux · debian · bookworm
[linux-bpf-dev]Unknown
Source package: [linux]
Details (2)
- 6.12.95-1~bpo12+1 · amd64 · bookworm-backports
  Not affected
  nvd · linux · debian · bookworm
- 6.12.95-1~bpo12+1 · arm64 · bookworm-backports
  Not affected
  nvd · linux · debian · bookworm
[linux-compiler-gcc-12-x86]Unknown
Source package: [linux]
Details (2)
- 6.1.176-1 · amd64 · bookworm
  Not affected
  nvd · linux · debian · bookworm
- 6.1.180-1 · amd64 · bookworm-security
  Not affected
  nvd · linux · debian · bookworm
[linux-config-6.1]Unknown
Source package: [linux]
Details (4)
- 6.1.176-1 · amd64 · bookworm
  Not affected
  nvd · linux · debian · bookworm
- 6.1.176-1 · arm64 · bookworm
  Not affected
  nvd · linux · debian · bookworm
- 6.1.180-1 · amd64 · bookworm-security
  Not affected
  nvd · linux · debian · bookworm
- 6.1.180-1 · arm64 · bookworm-security
  Not affected
  nvd · linux · debian · bookworm
[linux-cpupower]Unknown
Source package: [linux]
Details (6)
- 6.1.176-1 · amd64 · bookworm
  Not affected
  nvd · linux · debian · bookworm
- 6.1.176-1 · arm64 · bookworm
  Not affected
  nvd · linux · debian · bookworm
- 6.12.95-1~bpo12+1 · amd64 · bookworm-backports
  Not affected
  nvd · linux · debian · bookworm
- 6.12.95-1~bpo12+1 · arm64 · bookworm-backports
  Not affected
  nvd · linux · debian · bookworm
- 6.1.180-1 · amd64 · bookworm-security
  Not affected
  nvd · linux · debian · bookworm
- 6.1.180-1 · arm64 · bookworm-security
  Not affected
  nvd · linux · debian · bookworm
[linux-doc]Unknown
Source package: [linux]
Details (32)
- 6.1.170-3 · all · bookworm
  Not affected
  nvd · linux · debian · bookworm
- 6.1.170-3 · all · bookworm
  Not affected
  nvd · linux · debian · bookworm
- 6.1.176-1 · all · bookworm
  Not affected
  nvd · linux · debian · bookworm
- 6.1.176-1 · all · bookworm
  Not affected
  nvd · linux · debian · bookworm
- 6.12.43-1~bpo12+1 · all · bookworm-backports
  Not affected
  nvd · linux · debian · bookworm
- 6.12.43-1~bpo12+1 · all · bookworm-backports
  Not affected
  nvd · linux · debian · bookworm
- 6.12.57-1~bpo12+1 · all · bookworm-backports
  Not affected
  nvd · linux · debian · bookworm
- 6.12.57-1~bpo12+1 · all · bookworm-backports
  Not affected
  nvd · linux · debian · bookworm
- 6.12.63-1~bpo12+1 · all · bookworm-backports
  Not affected
  nvd · linux · debian · bookworm
- 6.12.63-1~bpo12+1 · all · bookworm-backports
  Not affected
  nvd · linux · debian · bookworm
- 6.12.69-1~bpo12+1 · all · bookworm-backports
  Not affected
  nvd · linux · debian · bookworm
- 6.12.69-1~bpo12+1 · all · bookworm-backports
  Not affected
  nvd · linux · debian · bookworm
- 6.12.73-1~bpo12+1 · all · bookworm-backports
  Not affected
  nvd · linux · debian · bookworm
- 6.12.73-1~bpo12+1 · all · bookworm-backports
  Not affected
  nvd · linux · debian · bookworm
- 6.12.74-2~bpo12+1 · all · bookworm-backports
  Not affected
  nvd · linux · debian · bookworm
- 6.12.74-2~bpo12+1 · all · bookworm-backports
  Not affected
  nvd · linux · debian · bookworm
- 6.12.85-1~bpo12+1 · all · bookworm-backports
  Not affected
  nvd · linux · debian · bookworm
- 6.12.85-1~bpo12+1 · all · bookworm-backports
  Not affected
  nvd · linux · debian · bookworm
- 6.12.86-1~bpo12+1 · all · bookworm-backports
  Not affected
  nvd · linux · debian · bookworm
- 6.12.86-1~bpo12+1 · all · bookworm-backports
  Not affected
  nvd · linux · debian · bookworm
- 6.12.88-1~bpo12+1 · all · bookworm-backports
  Not affected
  nvd · linux · debian · bookworm
- 6.12.88-1~bpo12+1 · all · bookworm-backports
  Not affected
  nvd · linux · debian · bookworm
- 6.12.90-1~bpo12+1 · all · bookworm-backports
  Not affected
  nvd · linux · debian · bookworm
- 6.12.90-1~bpo12+1 · all · bookworm-backports
  Not affected
  nvd · linux · debian · bookworm
- 6.12.90-2~bpo12+1 · all · bookworm-backports
  Not affected
  nvd · linux · debian · bookworm
- 6.12.90-2~bpo12+1 · all · bookworm-backports
  Not affected
  nvd · linux · debian · bookworm
- 6.12.94-1~bpo12+1 · all · bookworm-backports
  Not affected
  nvd · linux · debian · bookworm
- 6.12.94-1~bpo12+1 · all · bookworm-backports
  Not affected
  nvd · linux · debian · bookworm
- 6.12.95-1~bpo12+1 · all · bookworm-backports
  Not affected
  nvd · linux · debian · bookworm
- 6.12.95-1~bpo12+1 · all · bookworm-backports
  Not affected
  nvd · linux · debian · bookworm
- 6.1.180-1 · all · bookworm-security
  Not affected
  nvd · linux · debian · bookworm
- 6.1.180-1 · all · bookworm-security
  Not affected
  nvd · linux · debian · bookworm
[linux-doc-6.1]Unknown
Source package: [linux]
Details (6)
- 6.1.170-3 · all · bookworm
  Not affected
  nvd · linux · debian · bookworm
- 6.1.170-3 · all · bookworm
  Not affected
  nvd · linux · debian · bookworm
- 6.1.176-1 · all · bookworm
  Not affected
  nvd · linux · debian · bookworm
- 6.1.176-1 · all · bookworm
  Not affected
  nvd · linux · debian · bookworm
- 6.1.180-1 · all · bookworm-security
  Not affected
  nvd · linux · debian · bookworm
- 6.1.180-1 · all · bookworm-security
  Not affected
  nvd · linux · debian · bookworm
[linux-headers-6.1.0-47-amd64]Unknown
Source package: [linux]
Details (1)
- 6.1.170-3 · amd64 · bookworm
  Not affected
  nvd · linux · debian · bookworm
[linux-headers-6.1.0-47-arm64]Unknown
Source package: [linux]
Details (1)
- 6.1.170-3 · arm64 · bookworm
  Not affected
  nvd · linux · debian · bookworm
[linux-headers-6.1.0-47-cloud-amd64]Unknown
Source package: [linux]
Details (1)
- 6.1.170-3 · amd64 · bookworm
  Not affected
  nvd · linux · debian · bookworm
[linux-headers-6.1.0-47-cloud-arm64]Unknown
Source package: [linux]
Details (1)
- 6.1.170-3 · arm64 · bookworm
  Not affected
  nvd · linux · debian · bookworm
[linux-headers-6.1.0-47-common]Unknown
Source package: [linux]
Details (2)
- 6.1.170-3 · all · bookworm
  Not affected
  nvd · linux · debian · bookworm
- 6.1.170-3 · all · bookworm
  Not affected
  nvd · linux · debian · bookworm
[linux-headers-6.1.0-47-common-rt]Unknown
Source package: [linux]
Details (2)
- 6.1.170-3 · all · bookworm
  Not affected
  nvd · linux · debian · bookworm
- 6.1.170-3 · all · bookworm
  Not affected
  nvd · linux · debian · bookworm
[linux-headers-6.1.0-47-rt-amd64]Unknown
Source package: [linux]
Details (1)
- 6.1.170-3 · amd64 · bookworm
  Not affected
  nvd · linux · debian · bookworm
[linux-headers-6.1.0-47-rt-arm64]Unknown
Source package: [linux]
Details (1)
- 6.1.170-3 · arm64 · bookworm
  Not affected
  nvd · linux · debian · bookworm
[linux-headers-6.1.0-50-amd64]Unknown
Source package: [linux]
Details (1)
- 6.1.176-1 · amd64 · bookworm
  Not affected
  nvd · linux · debian · bookworm

Next results

Observed: Oct 27, 2026, 4:41:28 AM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]