Description

In the Linux kernel, the following vulnerability has been resolved: powerpc/xive: propagate IPI init errors to prevent use-after-free When xive_init_ipis() fails (e.g. irq_domain_alloc_irqs() fails), the error path frees the global xive_ipis array. However, xive_smp_probe() previously ignored this failure and proceeded to call xive_setup_cpu_ipi(), which dereferences the already-freed xive_ipis pointer -- a use-after-free. Now that xive_smp_probe() returns int (previous patch), propagate the error from xive_init_ipis() and xive_setup_cpu_ipi() through xive_smp_probe(). Check the return value in both pnv_smp_probe() and pSeries_smp_probe() so that IPI setup is aborted cleanly on failure, avoiding the use-after-free.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-09-24T16:17:22.670Z",
  "pubdate": "2026-09-24T16:17:22.670Z",
  "executiveSummary": "This vulnerability is a use-after-free (UAF) flaw residing in the Linux kernel's PowerPC XIVE (eXternal Interrupt Virtualization Engine) subsystem. The vulnerability occurs during the initialization phase of Inter-Processor Interrupts (IPIs).\nAn attacker capable of triggering a system state where XIVE IPI initialization fails—such as resource exhaustion during irq_domain_alloc_irqs()—can cause the kernel to access memory that has already been deallocated.\nThe primary impact is potential kernel memory corruption, leading to system instability, denial-of-service (DoS), or potentially arbitrary code execution if an attacker can manipulate the freed memory contents before the subsequent dereference.\nThe vulnerability affects Linux kernel systems utilizing the XIVE interrupt controller on PowerPC architectures. Exploitation requires local access to trigger initialization paths, and success depends on the timing and state of the kernel memory allocator at the time of failure.",
  "technicalDetails": "The root cause of this vulnerability is improper error handling and state management within the powerpc/xive subsystem during SMP (Symmetric Multiprocessing) initialization.\nWhen xive_init_ipis() encounters an error, such as a failure in irq_domain_alloc_irqs(), the function executes an error cleanup path that invokes kfree() on the global 'xive_ipis' array, effectively releasing the associated kernel memory back to the allocator.\nPrior to the fix, the calling function, xive_smp_probe(), failed to validate the return status of xive_init_ipis(). Consequently, the execution flow continued unconditionally into xive_setup_cpu_ipi(). This subsequent function proceeds to dereference the 'xive_ipis' pointer, which now points to a freed memory region.\nThe attack flow proceeds as follows: 1) An initialization trigger occurs (e.g., system boot or platform-specific SMP probe). 2) The system attempts to allocate IPI resources via xive_init_ipis(). 3) The allocation fails, triggering the error path which deallocates the xive_ipis pointer. 4) The flow returns control to xive_smp_probe(), which ignores the error status. 5) xive_smp_probe() invokes xive_setup_cpu_ipi(), which performs a memory dereference on the dangling pointer.\nThis use-after-free condition allows for a race or deterministic exploitation if the memory previously occupied by 'xive_ipis' is reallocated by another kernel subsystem before the dangling pointer is accessed. If the attacker can influence the contents of this reallocated memory, they may achieve control over function pointers or data structures utilized by the XIVE subsystem, leading to kernel-level exploitation.\nThe vulnerability exists within the interaction between xive_init_ipis(), xive_smp_probe(), and xive_setup_cpu_ipi(). The fix involves propagating return codes from initialization functions up to the platform-specific callers pnv_smp_probe() and pSeries_smp_probe(), ensuring that any failure in IPI setup results in a clean abort rather than proceeding to unsafe memory operations."
}