CVE-2026-98395

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

powerpc/entry: Fix irq_soft_mask corruption on replayed interrupt exit

When __replay_soft_interrupts() replays a pending interrupt (e.g.

PACA_IRQ_DEC -> timer_interrupt), it calls the handler directly with a

synthetic pt_regs. The DEFINE_INTERRUPT_HANDLER_ASYNC wrapper around

each handler calls arch_interrupt_async_exit_prepare() on the way out,

which calls arch_interrupt_exit_prepare() -> local_irq_disable() ->

arch_local_irq_disable(), which does:

irq_soft_mask_set(IRQS_DISABLED) /* 0x1 */

This unconditionally overwrites irq_soft_mask with IRQS_DISABLED (0x1),

stripping the IRQS_PMI_DISABLED (0x2) bit. The result is that

irq_soft_mask is 0x1 instead of IRQS_ALL_DISABLED (0x3) when the

handler returns to __replay_soft_interrupts().

For a normally-taken interrupt this is harmless: the next interrupt

always enters through arch_interrupt_enter_prepare() which

unconditionally sets irq_soft_mask to IRQS_ALL_DISA

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References