CVE-2026-64070

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> powerpc/hv-gpci: fix preempt count leak in sysfs show paths<br /> <br /> Four sysfs show() callbacks in hv-gpci take get_cpu_var(hv_gpci_reqb)<br /> (which calls preempt_disable()) but only call the matching put_cpu_var()<br /> on the error path under the &amp;#39;out:&amp;#39; label. Every successful read leaks<br /> one preempt_disable():<br /> <br /> processor_bus_topology_show()<br /> processor_config_show()<br /> affinity_domain_via_virtual_processor_show()<br /> affinity_domain_via_domain_show()<br /> <br /> (affinity_domain_via_partition_show() was already correct.)<br /> <br /> On a CONFIG_PREEMPT=y kernel, repeated reads raise preempt_count and<br /> eventually return to userspace with preemption still disabled. The<br /> next user-mode page fault then hits faulthandler_disabled() == 1,<br /> gets forced to SIGSEGV, and the resulting coredump trips<br /> &amp;#39;BUG: scheduling while atomic&amp;#39; in call_usermodehelper_exec -&gt;<br /> wait_for_completion_state -&gt; schedule:<br /> <br /> BUG: scheduling while atomic: //0x00000004<br /> ...<br /> __schedule_bug+0x6c/0x90<br /> __schedule+0x58c/0x13a0<br /> schedule+0x48/0x1a0<br /> schedule_timeout+0x104/0x170<br /> wait_for_completion_state+0x16c/0x330<br /> call_usermodehelper_exec+0x254/0x2d0<br /> vfs_coredump+0x1050/0x2590<br /> get_signal+0xb9c/0xc80<br /> do_notify_resume+0xf8/0x470<br /> <br /> Add an out_success label that calls put_cpu_var() before returning<br /> the byte count, mirroring affinity_domain_via_partition_show().