{"id":28523,"date":"2026-09-25T00:31:35","date_gmt":"2026-09-24T16:31:35","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-93259"},"modified":"2026-09-25T00:31:35","modified_gmt":"2026-09-24T16:31:35","slug":"cve-2026-93259","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-93259","title":{"rendered":"CVE-2026-93259 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc\/irq: Fix miss"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>powerpc\/irq: Fix missing r2 clobber in PCREL inline assembly<\/p>\n<p>In CONFIG_PPC_KERNEL_PCREL mode, r2 is no longer reserved for the TOC<br \/>\npointer and is available as a caller-saved register [0].<\/p>\n<p>Both call_do_irq() and call_do_softirq() use inline assembly to call<br \/>\nfunctions with stack switching, but fail to list r2 in their clobber<br \/>\nlists. This causes the compiler to assume r2 is preserved across these<br \/>\ncalls, leading to register corruption when the called functions<br \/>\n(__do_irq and __do_softirq) clobber r2.<\/p>\n<p>As a result of this kernel crash during interrupt handling is seen and<br \/>\nthe kernel fails to boot:<\/p>\n<p>BUG: Unable to handle kernel data access on write at 0xc000000404697638<br \/>\nFaulting instruction address: 0xc0000000000181ec<br \/>\nOops: Kernel access of bad area, sig: 11 [#1]<br \/>\nNIP [c0000000000181ec] __do_IRQ+0x6c\/0xc0<\/p>\n<p>With older GCC, the compiler would conservatively allocate<br \/>\ncallee-saved registers (like r31) for values spanning function calls,<br \/>\naccidentally avoiding the bug:<\/p>\n<p>:<br \/>\n00 00 00 60 \tnop<br \/>\na6 02 08 7c \tmflr    r0<br \/>\nf8 ff e1 fb \tstd     r31,-8(r1)<br \/>\nf0 ff c1 fb \tstd     r30,-16(r1)<br \/>\n2d 03 10 06 \tpla     r31,53297316<\/p>\n<p>&#8230;<\/p>\n<p>3d e8 ff 4b \tbl      c0000000000165ac<br \/>\n00 00 21 e8 \tld      r1,0(r1)<br \/>\n28 00 4d e9 \tld      r10,40(r13)<br \/>\n40 00 21 38 \taddi    r1,r1,64<br \/>\n2a f9 aa 7f \tstdx    r29,r10,r31<\/p>\n<p>With newer GCC 14, the compiler uses r2 for such values, exposing the<br \/>\nmissing clobber specification:<\/p>\n<p>:<br \/>\n00 00 00 60     nop<br \/>\na6 02 08 7c     mflr    r0<br \/>\nf0 ff c1 fb     std     r30,-16(r1)<br \/>\nf8 ff e1 fb     std     r31,-8(r1)<br \/>\n29 02 10 06     pla     r2,36252592     # c0000000022aadc0 <\/p>\n<p>&#8230;<\/p>\n<p>85 dc ff 4b \tbl      c000000000015ee0<br \/>\n00 00 21 e8 \tld      r1,0(r1)<br \/>\n28 00 2d e9 \tld      r9,40(r13)<br \/>\n30 00 21 38 \taddi    r1,r1,48<br \/>\n2a 11 c9 7f \tstdx    r30,r9,r2<\/p>\n<p>Fix this by adding r2 to the clobber list for both call_do_irq() and<br \/>\ncall_do_softirq() when CONFIG_PPC_KERNEL_PCREL is enabled.<\/p>\n<p>[0]: https:\/\/www.mail-archive.com\/gcc-patches@gcc.gnu.org\/msg313226.html<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>powerpc\/irq: Fix missing r2 clobber in PCREL inline assembly<\/p>\n<p>In CONFIG_PPC_KERNEL_PCREL mode, r2 is no longer reserved for the TOC<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-28523","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/28523","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=28523"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=28523"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=28523"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}