CVE-2023-54267

powerpc/pseries: Rework lppaca_shared_proc() to avoid DEBUG_PREEMPT

N/A
Published: December 30, 2025 at 12:15 PM UTC
Updated: June 17, 2026 at 06:47 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
N/A
Exploit prediction
EPSS 0.2%

Description

In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: Rework lppaca_shared_proc() to avoid DEBUG_PREEMPT lppaca_shared_proc() takes a pointer to the lppaca which is typically accessed through get_lppaca(). With DEBUG_PREEMPT enabled, this leads to checking if preemption is enabled, for example: BUG: using smp_processor_id() in preemptible [00000000] code: grep/10693 caller is lparcfg_data+0x408/0x19a0 CPU: 4 PID: 10693 Comm: grep Not tainted 6.5.0-rc3 #2 Call Trace: dump_stack_lvl+0x154/0x200 (unreliable) check_preemption_disabled+0x214/0x220 lparcfg_data+0x408/0x19a0 ... This isn't actually a problem however, as it does not matter which lppaca is accessed, the shared proc state will be the same. vcpudispatch_stats_procfs_init() already works around this by disabling preemption, but the lparcfg code does not, erroring any time /proc/powerpc/lparcfg is accessed with DEBUG_PREEMPT enabled. Instead of disabling preemption on the caller side, rework lppaca_shared_proc() to not take a pointer and instead directly access the lppaca, bypassing any potential preemption checks. [mpe: Rework to avoid needing a definition in paca.h and lppaca.h]

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

3.12 ≤ v < 5.10.1953.12 ≤ v < 5.15.1323.12 ≤ v < 6.1.533.12 ≤ v < 6.4.163.12 ≤ v < 6.5.33.12 ≤ v < 6.63.12f13c13a005127b5dc5daaca190277a062d946e63
Vendor states this is fixed in 2935443dc9c28499223d8c881474259e4b998f2a (fixed)
Vendor states this is fixed in 3c5e8e666794d7dde6d14ea846c6c04f2bb34900 (fixed)
Vendor states this is fixed in 4c8568cf4c45b415854195c8832b557cdefba57a (fixed)
Vendor states this is fixed in 953c54dfdc5d3eb7243ed902b50acb5ea1db4355 (fixed)
Vendor states this is fixed in eac030b22ea12cdfcbb2e941c21c03964403c63f (fixed)
Vendor states this is fixed in f45ee5c074013a0fbfce77a5af5efddb01f5d4f4 (fixed)
Vendor states this is fixed in 3.12 (unaffected)
Vendor states this is fixed in 5.10.195 (unaffected)
Vendor states this is fixed in 5.15.132 (unaffected)
Vendor states this is fixed in 6.1.53 (unaffected)
Vendor states this is fixed in 6.4.16 (unaffected)
Vendor states this is fixed in 6.5.3 (unaffected)
Vendor states this is fixed in 6.6 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

Quick Info

StatusDEFERRED

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card