CVE-2026-93259

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> powerpc/irq: Fix missing r2 clobber in PCREL inline assembly<br /> <br /> In CONFIG_PPC_KERNEL_PCREL mode, r2 is no longer reserved for the TOC<br /> pointer and is available as a caller-saved register [0].<br /> <br /> Both call_do_irq() and call_do_softirq() use inline assembly to call<br /> functions with stack switching, but fail to list r2 in their clobber<br /> lists. This causes the compiler to assume r2 is preserved across these<br /> calls, leading to register corruption when the called functions<br /> (__do_irq and __do_softirq) clobber r2.<br /> <br /> As a result of this kernel crash during interrupt handling is seen and<br /> the kernel fails to boot:<br /> <br /> BUG: Unable to handle kernel data access on write at 0xc000000404697638<br /> Faulting instruction address: 0xc0000000000181ec<br /> Oops: Kernel access of bad area, sig: 11 [#1]<br /> NIP [c0000000000181ec] __do_IRQ+0x6c/0xc0<br /> <br /> With older GCC, the compiler would conservatively allocate<br /> callee-saved registers (like r31) for values spanning function calls,<br /> accidentally avoiding the bug:<br /> <br /> :<br /> 00 00 00 60 nop<br /> a6 02 08 7c mflr r0<br /> f8 ff e1 fb std r31,-8(r1)<br /> f0 ff c1 fb std r30,-16(r1)<br /> 2d 03 10 06 pla r31,53297316<br /> <br /> ...<br /> <br /> 3d e8 ff 4b bl c0000000000165ac <br /> 00 00 21 e8 ld r1,0(r1)<br /> 28 00 4d e9 ld r10,40(r13)<br /> 40 00 21 38 addi r1,r1,64<br /> 2a f9 aa 7f stdx r29,r10,r31<br /> <br /> With newer GCC 14, the compiler uses r2 for such values, exposing the<br /> missing clobber specification:<br /> <br /> :<br /> 00 00 00 60 nop<br /> a6 02 08 7c mflr r0<br /> f0 ff c1 fb std r30,-16(r1)<br /> f8 ff e1 fb std r31,-8(r1)<br /> 29 02 10 06 pla r2,36252592 # c0000000022aadc0 <br /> <br /> ...<br /> <br /> 85 dc ff 4b bl c000000000015ee0 <br /> 00 00 21 e8 ld r1,0(r1)<br /> 28 00 2d e9 ld r9,40(r13)<br /> 30 00 21 38 addi r1,r1,48<br /> 2a 11 c9 7f stdx r30,r9,r2<br /> <br /> Fix this by adding r2 to the clobber list for both call_do_irq() and<br /> call_do_softirq() when CONFIG_PPC_KERNEL_PCREL is enabled.<br /> <br /> [0]: https://www.mail-archive.com/gcc-patches@gcc.gnu.org/msg313226.html