CVE-2026-98395
N/AIn the Linux kernel, the following vulnerability has been resolved: powerpc/entry: Fix irq_soft_mask corruption on replayed interrupt exit When __replay_soft_interrupts() replays a pending interrupt (e.g. PACA_IRQ_DEC -> timer_interrupt), it calls the handler directly with a synthetic pt_regs. The DEFINE_INTERRUPT_HANDLER_ASYNC wrapper around each handler calls arch_interrupt_async_exit_prepare() on the way out, which calls arch_interrupt_exit_prepare() -> local_irq_disable() -> arch_local_irq_disable(), which does: irq_soft_mask_set(IRQS_DISABLED) /* 0x1 */ This unconditionally overwrites irq_soft_mask with IRQS_DISABLED (0x1), stripping the IRQS_PMI_DISABLED (0x2) bit. The result is that irq_soft_mask is 0x1 instead of IRQS_ALL_DISABLED (0x3) when the handler returns to __replay_soft_interrupts(). For a normally-taken interrupt this is harmless: the next interrupt always enters through arch_interrupt_enter_prepare() which unconditionally sets irq_soft_mask to IRQS_ALL_DISABLED. But during replay, next_interrupt() is called directly between replayed handlers without going back through arch_interrupt_enter_prepare(), so the stripped bit is never restored. next_interrupt() then fires a WARNING: WARNING: arch/powerpc/kernel/irq_64.c:75 WARN_ON(irq_soft_mask_return() != IRQS_ALL_DISABLED) The warning was observed early in boot on a POWER10 pseries guest during kmem_cache_init_late(), where a spinlock release triggers interrupt replay that processes a pending timer interrupt. Debugger state confirming the bug: Before timer_interrupt(®s): irq_soft_mask = 0x3 (IRQS_ALL_DISABLED) correct irq_happened = 0x41 (HARD_DIS|REPLAYING) correct After timer_interrupt(®s) returns: irq_soft_mask = 0x1 (IRQS_DISABLED) WRONG - PMI bit stripped irq_happened = 0x41 unchanged The fix is to replace local_irq_disable() with hard_irq_disable(). hard_irq_disable() is the right primitive here for two reasons: 1. On PPC64 (hw_irq.h:301) it calls irq_soft_mask_set_return(IRQS_ALL_DISABLED), setting the soft mask to 0x3 (both IRQS_DISABLED and IRQS_PMI_DISABLED), which preserves the PMI bit and fixes the WARNING. The additional work it does (__hard_irq_disable(), PACA_IRQ_HARD_DIS |=) is redundant but safe since both are already set at this point in the exit path; the trace_hardirqs_off() inside is guarded by if (!arch_irqs_disabled_flags(flags)) so it will not double-fire. 2. On PPC32 (hw_irq.h:467) hard_irq_disable() maps to arch_local_irq_disable() -> __hard_irq_disable(), which clears MSR[EE] in hardware. This is exactly correct: PPC32 has no soft-mask PACA mechanism, so the hardware disable is the right way to satisfy irqentry_exit()'s requirement. This also fixes a build error on PPC32 where irq_soft_mask_set() is only defined under CONFIG_PPC64: arch/powerpc/include/asm/entry-common.h:273: error: implicit declaration of function 'irq_soft_mask_set' Using hard_irq_disable() requires no #ifdef and is consistent with how the rest of the entry code (e.g. entry-common.h:463) handles the same PPC32/PPC64 split.
No known exploitation, public exploit, or elevated probability at this time. Track for changes.
Exploitation likelihood
0.2%chance of exploitation in 30 days · 8th percentile
Impact if exploited
—CVSS · not scored
- No impact metrics
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
References and research data (JSON)
Vendor product assessments
Showing 32 of 277 vendor product statements; 245 omitted. Read the full vendor advisory.
kernel as a component of Red Hat Enterprise Linux 10 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel
Red Hat · CVE-2026-98395 · Updated 2026-10-15T13:56:01+00:00kernel-64k-debug-modules-extra as a component of Red Hat Enterprise Linux 10 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-64k-debug-modules-extra
Red Hat · CVE-2026-98395 · Updated 2026-10-15T13:56:01+00:00kernel-debug-core as a component of Red Hat Enterprise Linux 10 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-debug-core
Red Hat · CVE-2026-98395 · Updated 2026-10-15T13:56:01+00:00kernel-doc as a component of Red Hat Enterprise Linux 10 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-doc
Red Hat · CVE-2026-98395 · Updated 2026-10-15T13:56:01+00:00kernel-rt-64k-debug as a component of Red Hat Enterprise Linux 10 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-64k-debug
Red Hat · CVE-2026-98395 · Updated 2026-10-15T13:56:01+00:00kernel-rt-64k-modules-extra as a component of Red Hat Enterprise Linux 10 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-64k-modules-extra
Red Hat · CVE-2026-98395 · Updated 2026-10-15T13:56:01+00:00kernel-rt-debug-modules-extra as a component of Red Hat Enterprise Linux 10 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-debug-modules-extra
Red Hat · CVE-2026-98395 · Updated 2026-10-15T13:56:01+00:00kernel-uki-virt as a component of Red Hat Enterprise Linux 10 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-uki-virt
Red Hat · CVE-2026-98395 · Updated 2026-10-15T13:56:01+00:00kernel.src as a component of Red Hat Enterprise Linux 10 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel?arch=src
Red Hat · CVE-2026-98395 · Updated 2026-10-15T13:56:01+00:00kernel-debug as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-debug
Red Hat · CVE-2026-98395 · Updated 2026-10-15T13:56:01+00:00perf as a component of Red Hat Enterprise Linux 6 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/perf
Red Hat · CVE-2026-98395 · Updated 2026-10-15T13:56:01+00:00kernel-doc as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-doc
Red Hat · CVE-2026-98395 · Updated 2026-10-15T13:56:01+00:00kernel-rt-doc as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-doc
Red Hat · CVE-2026-98395 · Updated 2026-10-15T13:56:01+00:00kernel.src as a component of Red Hat Enterprise Linux 7 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel?arch=src
Red Hat · CVE-2026-98395 · Updated 2026-10-15T13:56:01+00:00kernel-debug as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-debug
Red Hat · CVE-2026-98395 · Updated 2026-10-15T13:56:01+00:00kernel-ipaclones-internal as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-ipaclones-internal
Red Hat · CVE-2026-98395 · Updated 2026-10-15T13:56:01+00:00kernel-rt-debug-devel as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-debug-devel
Red Hat · CVE-2026-98395 · Updated 2026-10-15T13:56:01+00:00kernel-rt-modules-internal as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-modules-internal
Red Hat · CVE-2026-98395 · Updated 2026-10-15T13:56:01+00:00kernel-zfcpdump-devel as a component of Red Hat Enterprise Linux 8 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-zfcpdump-devel
Red Hat · CVE-2026-98395 · Updated 2026-10-15T13:56:01+00:00kernel-64k as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-64k
Red Hat · CVE-2026-98395 · Updated 2026-10-15T13:56:01+00:00kernel-64k-debug-modules-internal as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-64k-debug-modules-internal
Red Hat · CVE-2026-98395 · Updated 2026-10-15T13:56:01+00:00kernel-abi-stablelists as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-abi-stablelists
Red Hat · CVE-2026-98395 · Updated 2026-10-15T13:56:01+00:00kernel-debug-modules-extra as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-debug-modules-extra
Red Hat · CVE-2026-98395 · Updated 2026-10-15T13:56:01+00:00kernel-ipaclones-internal as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-ipaclones-internal
Red Hat · CVE-2026-98395 · Updated 2026-10-15T13:56:01+00:00kernel-rt-64k-debug as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-64k-debug
Red Hat · CVE-2026-98395 · Updated 2026-10-15T13:56:01+00:00kernel-rt-64k-debug-modules-partner as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-64k-debug-modules-partner
Red Hat · CVE-2026-98395 · Updated 2026-10-15T13:56:01+00:00kernel-rt-64k-modules-partner as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-64k-modules-partner
Red Hat · CVE-2026-98395 · Updated 2026-10-15T13:56:01+00:00kernel-rt-debug-modules-extra as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-debug-modules-extra
Red Hat · CVE-2026-98395 · Updated 2026-10-15T13:56:01+00:00kernel-rt-modules-internal as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-rt-modules-internal
Red Hat · CVE-2026-98395 · Updated 2026-10-15T13:56:01+00:00kernel-uki-virt-addons as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-uki-virt-addons
Red Hat · CVE-2026-98395 · Updated 2026-10-15T13:56:01+00:00kernel-zfcpdump-modules-partner as a component of Red Hat Enterprise Linux 9 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:rpm/redhat/kernel-zfcpdump-modules-partner
Red Hat · CVE-2026-98395 · Updated 2026-10-15T13:56:01+00:00openshift/ose-rhel-coreos-9 as a component of Red Hat OpenShift Container Platform 4 · known not affected
Vendor assessment for this product only.
Reason: vulnerable code not present
pkg:oci/ose-rhel-coreos-9?repository_url=registry.redhat.io/openshift/ose-rhel-coreos-9
Red Hat · CVE-2026-98395 · Updated 2026-10-15T13:56:01+00:00
References
Advisories
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98395.json Red Hat · CVE-2026-98395 · Updated 2026-10-15T13:56:01+00:00
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-101044 EUVD · EUVD-2026-101044
Technical & other
- https://git.kernel.org/stable/c/95cd316a896f1c1aa4ee4a817ba3d4691103c81bCVE record · Linux · Updated 2026-10-19T09:18:48.849Z
NVD · CVE-2026-98395 · Updated 2026-10-19T10:18:42.880 - https://git.kernel.org/stable/c/63a7531ca31f9f097d9cc1cc3fe86ae683cdabddCVE record · Linux · Updated 2026-10-19T09:18:48.849Z
NVD · CVE-2026-98395 · Updated 2026-10-19T10:18:42.880 - https://access.redhat.com/security/cve/CVE-2026-98395 Red Hat · CVE-2026-98395 · Updated 2026-10-15T13:56:01+00:00
- https://bugzilla.redhat.com/show_bug.cgi?id=2552202 Red Hat · CVE-2026-98395 · Updated 2026-10-15T13:56:01+00:00
- https://www.cve.org/CVERecord?id=CVE-2026-98395 Red Hat · CVE-2026-98395 · Updated 2026-10-15T13:56:01+00:00
- https://nvd.nist.gov/vuln/detail/CVE-2026-98395 Red Hat · CVE-2026-98395 · Updated 2026-10-15T13:56:01+00:00
- https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98395.mbox Red Hat · CVE-2026-98395 · Updated 2026-10-15T13:56:01+00:00