{"api_version":"1","generated_at":"2026-09-25T15:14:09+00:00","cve":"CVE-2026-93259","urls":{"html":"https://cve.report/CVE-2026-93259","api":"https://cve.report/api/cve/CVE-2026-93259.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-93259","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-93259"},"summary":{"title":"powerpc/irq: Fix missing r2 clobber in PCREL inline assembly","description":"In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/irq: Fix missing r2 clobber in PCREL inline assembly\n\nIn CONFIG_PPC_KERNEL_PCREL mode, r2 is no longer reserved for the TOC\npointer and is available as a caller-saved register [0].\n\nBoth call_do_irq() and call_do_softirq() use inline assembly to call\nfunctions with stack switching, but fail to list r2 in their clobber\nlists. This causes the compiler to assume r2 is preserved across these\ncalls, leading to register corruption when the called functions\n(__do_irq and __do_softirq) clobber r2.\n\nAs a result of this kernel crash during interrupt handling is seen and\nthe kernel fails to boot:\n\nBUG: Unable to handle kernel data access on write at 0xc000000404697638\nFaulting instruction address: 0xc0000000000181ec\nOops: Kernel access of bad area, sig: 11 [#1]\nNIP [c0000000000181ec] __do_IRQ+0x6c/0xc0\n\nWith older GCC, the compiler would conservatively allocate\ncallee-saved registers (like r31) for values spanning function calls,\naccidentally avoiding the bug:\n\n<__do_IRQ>:\n00 00 00 60 \tnop\na6 02 08 7c \tmflr    r0\nf8 ff e1 fb \tstd     r31,-8(r1)\nf0 ff c1 fb \tstd     r30,-16(r1)\n2d 03 10 06 \tpla     r31,53297316\n\n...\n\n3d e8 ff 4b \tbl      c0000000000165ac <__do_irq>\n00 00 21 e8 \tld      r1,0(r1)\n28 00 4d e9 \tld      r10,40(r13)\n40 00 21 38 \taddi    r1,r1,64\n2a f9 aa 7f \tstdx    r29,r10,r31\n\nWith newer GCC 14, the compiler uses r2 for such values, exposing the\nmissing clobber specification:\n\n<__do_IRQ>:\n00 00 00 60     nop\na6 02 08 7c     mflr    r0\nf0 ff c1 fb     std     r30,-16(r1)\nf8 ff e1 fb     std     r31,-8(r1)\n29 02 10 06     pla     r2,36252592     # c0000000022aadc0 <__irq_regs>\n\n...\n\n85 dc ff 4b \tbl      c000000000015ee0 <__do_irq>\n00 00 21 e8 \tld      r1,0(r1)\n28 00 2d e9 \tld      r9,40(r13)\n30 00 21 38 \taddi    r1,r1,48\n2a 11 c9 7f \tstdx    r30,r9,r2\n\nFix this by adding r2 to the clobber list for both call_do_irq() and\ncall_do_softirq() when CONFIG_PPC_KERNEL_PCREL is enabled.\n\n[0]: https://www.mail-archive.com/gcc-patches@gcc.gnu.org/msg313226.html","state":"PUBLISHED","assigner":"Linux","published_at":"2026-09-24 16:17:22","updated_at":"2026-09-24 16:17:22"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/dcc442a49c0f540193910dacdca7506bcadc7ec5","name":"https://git.kernel.org/stable/c/dcc442a49c0f540193910dacdca7506bcadc7ec5","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/7b0093b638c8f2b94b0778a69fd1ccad54299b29","name":"https://git.kernel.org/stable/c/7b0093b638c8f2b94b0778a69fd1ccad54299b29","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/00be69070d91d2be978e752bb117a0a4db0e1281","name":"https://git.kernel.org/stable/c/00be69070d91d2be978e752bb117a0a4db0e1281","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/90d953002cf0b233dd053a0e7cb67ab79cebd0e3","name":"https://git.kernel.org/stable/c/90d953002cf0b233dd053a0e7cb67ab79cebd0e3","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/602ee44415f3eaa7893f7fc488c7c1d4a0bdbd7a","name":"https://git.kernel.org/stable/c/602ee44415f3eaa7893f7fc488c7c1d4a0bdbd7a","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-93259","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93259","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 7e3a68be42e10f5fa5890e97afc0afd992355bc3 dcc442a49c0f540193910dacdca7506bcadc7ec5 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 7e3a68be42e10f5fa5890e97afc0afd992355bc3 602ee44415f3eaa7893f7fc488c7c1d4a0bdbd7a git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 7e3a68be42e10f5fa5890e97afc0afd992355bc3 90d953002cf0b233dd053a0e7cb67ab79cebd0e3 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 7e3a68be42e10f5fa5890e97afc0afd992355bc3 7b0093b638c8f2b94b0778a69fd1ccad54299b29 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 7e3a68be42e10f5fa5890e97afc0afd992355bc3 00be69070d91d2be978e752bb117a0a4db0e1281 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6.4","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.4 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.157 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.110 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.52 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.6 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3-rc1 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["arch/powerpc/kernel/irq.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"dcc442a49c0f540193910dacdca7506bcadc7ec5","status":"affected","version":"7e3a68be42e10f5fa5890e97afc0afd992355bc3","versionType":"git"},{"lessThan":"602ee44415f3eaa7893f7fc488c7c1d4a0bdbd7a","status":"affected","version":"7e3a68be42e10f5fa5890e97afc0afd992355bc3","versionType":"git"},{"lessThan":"90d953002cf0b233dd053a0e7cb67ab79cebd0e3","status":"affected","version":"7e3a68be42e10f5fa5890e97afc0afd992355bc3","versionType":"git"},{"lessThan":"7b0093b638c8f2b94b0778a69fd1ccad54299b29","status":"affected","version":"7e3a68be42e10f5fa5890e97afc0afd992355bc3","versionType":"git"},{"lessThan":"00be69070d91d2be978e752bb117a0a4db0e1281","status":"affected","version":"7e3a68be42e10f5fa5890e97afc0afd992355bc3","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["arch/powerpc/kernel/irq.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.4"},{"lessThan":"6.4","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.157","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.110","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.52","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3-rc1","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.157","versionStartIncluding":"6.4","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.110","versionStartIncluding":"6.4","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.52","versionStartIncluding":"6.4","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.6","versionStartIncluding":"6.4","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3-rc1","versionStartIncluding":"6.4","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/irq: Fix missing r2 clobber in PCREL inline assembly\n\nIn CONFIG_PPC_KERNEL_PCREL mode, r2 is no longer reserved for the TOC\npointer and is available as a caller-saved register [0].\n\nBoth call_do_irq() and call_do_softirq() use inline assembly to call\nfunctions with stack switching, but fail to list r2 in their clobber\nlists. This causes the compiler to assume r2 is preserved across these\ncalls, leading to register corruption when the called functions\n(__do_irq and __do_softirq) clobber r2.\n\nAs a result of this kernel crash during interrupt handling is seen and\nthe kernel fails to boot:\n\nBUG: Unable to handle kernel data access on write at 0xc000000404697638\nFaulting instruction address: 0xc0000000000181ec\nOops: Kernel access of bad area, sig: 11 [#1]\nNIP [c0000000000181ec] __do_IRQ+0x6c/0xc0\n\nWith older GCC, the compiler would conservatively allocate\ncallee-saved registers (like r31) for values spanning function calls,\naccidentally avoiding the bug:\n\n<__do_IRQ>:\n00 00 00 60 \tnop\na6 02 08 7c \tmflr    r0\nf8 ff e1 fb \tstd     r31,-8(r1)\nf0 ff c1 fb \tstd     r30,-16(r1)\n2d 03 10 06 \tpla     r31,53297316\n\n...\n\n3d e8 ff 4b \tbl      c0000000000165ac <__do_irq>\n00 00 21 e8 \tld      r1,0(r1)\n28 00 4d e9 \tld      r10,40(r13)\n40 00 21 38 \taddi    r1,r1,64\n2a f9 aa 7f \tstdx    r29,r10,r31\n\nWith newer GCC 14, the compiler uses r2 for such values, exposing the\nmissing clobber specification:\n\n<__do_IRQ>:\n00 00 00 60     nop\na6 02 08 7c     mflr    r0\nf0 ff c1 fb     std     r30,-16(r1)\nf8 ff e1 fb     std     r31,-8(r1)\n29 02 10 06     pla     r2,36252592     # c0000000022aadc0 <__irq_regs>\n\n...\n\n85 dc ff 4b \tbl      c000000000015ee0 <__do_irq>\n00 00 21 e8 \tld      r1,0(r1)\n28 00 2d e9 \tld      r9,40(r13)\n30 00 21 38 \taddi    r1,r1,48\n2a 11 c9 7f \tstdx    r30,r9,r2\n\nFix this by adding r2 to the clobber list for both call_do_irq() and\ncall_do_softirq() when CONFIG_PPC_KERNEL_PCREL is enabled.\n\n[0]: https://www.mail-archive.com/gcc-patches@gcc.gnu.org/msg313226.html"}],"providerMetadata":{"dateUpdated":"2026-09-24T15:51:45.772Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/dcc442a49c0f540193910dacdca7506bcadc7ec5"},{"url":"https://git.kernel.org/stable/c/602ee44415f3eaa7893f7fc488c7c1d4a0bdbd7a"},{"url":"https://git.kernel.org/stable/c/90d953002cf0b233dd053a0e7cb67ab79cebd0e3"},{"url":"https://git.kernel.org/stable/c/7b0093b638c8f2b94b0778a69fd1ccad54299b29"},{"url":"https://git.kernel.org/stable/c/00be69070d91d2be978e752bb117a0a4db0e1281"}],"title":"powerpc/irq: Fix missing r2 clobber in PCREL inline assembly","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-93259","datePublished":"2026-09-24T15:51:45.772Z","dateReserved":"2026-09-17T16:02:15.097Z","dateUpdated":"2026-09-24T15:51:45.772Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-24 16:17:22","lastModifiedDate":"2026-09-24 16:17:22","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"93259","Ordinal":"1","Title":"powerpc/irq: Fix missing r2 clobber in PCREL inline assembly","CVE":"CVE-2026-93259","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"93259","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/irq: Fix missing r2 clobber in PCREL inline assembly\n\nIn CONFIG_PPC_KERNEL_PCREL mode, r2 is no longer reserved for the TOC\npointer and is available as a caller-saved register [0].\n\nBoth call_do_irq() and call_do_softirq() use inline assembly to call\nfunctions with stack switching, but fail to list r2 in their clobber\nlists. This causes the compiler to assume r2 is preserved across these\ncalls, leading to register corruption when the called functions\n(__do_irq and __do_softirq) clobber r2.\n\nAs a result of this kernel crash during interrupt handling is seen and\nthe kernel fails to boot:\n\nBUG: Unable to handle kernel data access on write at 0xc000000404697638\nFaulting instruction address: 0xc0000000000181ec\nOops: Kernel access of bad area, sig: 11 [#1]\nNIP [c0000000000181ec] __do_IRQ+0x6c/0xc0\n\nWith older GCC, the compiler would conservatively allocate\ncallee-saved registers (like r31) for values spanning function calls,\naccidentally avoiding the bug:\n\n<__do_IRQ>:\n00 00 00 60 \tnop\na6 02 08 7c \tmflr    r0\nf8 ff e1 fb \tstd     r31,-8(r1)\nf0 ff c1 fb \tstd     r30,-16(r1)\n2d 03 10 06 \tpla     r31,53297316\n\n...\n\n3d e8 ff 4b \tbl      c0000000000165ac <__do_irq>\n00 00 21 e8 \tld      r1,0(r1)\n28 00 4d e9 \tld      r10,40(r13)\n40 00 21 38 \taddi    r1,r1,64\n2a f9 aa 7f \tstdx    r29,r10,r31\n\nWith newer GCC 14, the compiler uses r2 for such values, exposing the\nmissing clobber specification:\n\n<__do_IRQ>:\n00 00 00 60     nop\na6 02 08 7c     mflr    r0\nf0 ff c1 fb     std     r30,-16(r1)\nf8 ff e1 fb     std     r31,-8(r1)\n29 02 10 06     pla     r2,36252592     # c0000000022aadc0 <__irq_regs>\n\n...\n\n85 dc ff 4b \tbl      c000000000015ee0 <__do_irq>\n00 00 21 e8 \tld      r1,0(r1)\n28 00 2d e9 \tld      r9,40(r13)\n30 00 21 38 \taddi    r1,r1,48\n2a 11 c9 7f \tstdx    r30,r9,r2\n\nFix this by adding r2 to the clobber list for both call_do_irq() and\ncall_do_softirq() when CONFIG_PPC_KERNEL_PCREL is enabled.\n\n[0]: https://www.mail-archive.com/gcc-patches@gcc.gnu.org/msg313226.html","Type":"Description","Title":"powerpc/irq: Fix missing r2 clobber in PCREL inline assembly"}]}}}