High 7.4Published Sep 24, 2026

CVE-2026-93260powerpc/xive: propagate IPI init errors to prevent use-after-free

Updated under an hour ago (Oct 27, 2026, 6:40 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: powerpc/xive: propagate IPI init errors to prevent use-after-free When xive_init_ipis() fails (e.g. irq_domain_alloc_irqs() fails), the error path frees the global xive_ipis array. However, xive_smp_probe() previously ignored this failure and proceeded to call xive_setup_cpu_ipi(), which dereferences the already-freed xive_ipis pointer -- a use-after-free. Now that xive_smp_probe() returns int (previous patch), propagate the error from xive_init_ipis() and xive_setup_cpu_ipi() through xive_smp_probe(). Check the return value in both pnv_smp_probe() and pSeries_smp_probe() so that IPI setup is aborted cleanly on failure, avoiding the use-after-free.

CVSS: 7.4 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 21, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 243e25112d06b348f087a6f7aba4bbc288285bdd before e36b1c2eafcaaddefa70d55e6fda74cf6cda38af; 243e25112d06b348f087a6f7aba4bbc288285bdd builds before 2ea6238343691309e68308131c7e80c3ae05afea; 243e25112d06b348f087a6f7aba4bbc288285bdd builds before 5c9ab0c9cede9f149733d330e2d7d45341b71359; from 243e25112d06b348f087a6f7aba4bbc288285bdd before c554a8d376d5aea1b237ed6bef6f9fbfc550e67f; from 243e25112d06b348f087a6f7aba4bbc288285bdd before 411a3c016e7a95f5fa105a0587e07d0647a77727	CNA record

References

References

https://git.kernel.org/stable/c/e36b1c2eafcaaddefa70d55e6fda74cf6cda38af
https://git.kernel.org/stable/c/2ea6238343691309e68308131c7e80c3ae05afea
https://git.kernel.org/stable/c/5c9ab0c9cede9f149733d330e2d7d45341b71359
https://git.kernel.org/stable/c/c554a8d376d5aea1b237ed6bef6f9fbfc550e67f
https://git.kernel.org/stable/c/411a3c016e7a95f5fa105a0587e07d0647a77727

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.