ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-98396

powerpc: Do not restore KUAP in arch_exit_to_user_mode_prepare()

Published Oct 14, 2026 · catalog updated Oct 15, 2026 · powerpc: Do not restore

Check if you run it

No confirmed exploitation is on record for CVE-2026-98396. EPSS is 0.20%. Act only if a listed version of powerpc: Do not restore is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (powerpc: Do not restore).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
High—
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.20%
Remediation
Advisory link
Affected products
Linux Kernel

In the Linux kernel, the following vulnerability has been resolved: powerpc: Do not restore KUAP in arch_exit_to_user_mode_prepare() KUAP means kernel cannot touch user memory unless it explicitly is enabled. In the kernel it should stay AMR_KUAP_BLOCKED. While returning to userspace just before RFI, kernel should restore the user AMR value back. Looks like GENERIC_ENTRY might be treating arch_exit_to_user_mode_prepare() as the last architecture step before returning to userspace. commit bee25f97ad24 ("powerpc: Enable GENERIC_ENTRY feature") therefore called kuap_user_restore() from that hook. But on PowerPC that is too early. After irqentry_exit() / syscall_exit_to_user_mode() we still run platform specific exit routines. e.g. code snippets showing both exception handling and system call handling as the callers of function arch_exit_to_user_mode_prepare() which does kuap_user_restore(). The below path shows that calling kuap_user_restore() is too early when called from arch_exit_to_user_mode_prepare(). Exception handling in exceptions-64s.S ======================================= bl CFUNC(do_page_fault) ..DEFINE_INTERRUPT_HANDLER_ASYNC(do_page_fault) arch_interrupt_async_enter_prepare(regs); state = irqentry_enter(regs); instrumentation_begin(); irq_enter_rcu(); handler(regs); nap_adjust_return(regs); irq_exit_rcu(); instrumentation_end(); arch_interrupt_async_exit_prepare(regs); irqentry_exit(regs, state); CR: 44000804 XER: 20040000 interrupt_exit_user_prepare+0x1a0/0x1c0 interrupt_return_srr_user+0x8/0x12c

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Linux Kernel7.2.0 → 7.2.7

How to fix CVE-2026-98396

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-98396. EPSS is 0.20%. Act only if a listed version of powerpc: Do not restore is installed.

Which versions are affected?

Compare what you have installed with Kernel 7.2.0 → 7.2.7. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

No weakness class is stored. EPSS 0.20%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 14, 2026 · OpenSSF OSV / OSV Scanner

    Detected

    In the Linux kernel, the following vulnerability has been resolved: powerpc: Do not restore KUAP in arch_exit_to_user_mode_prepare() KUAP means kernel cannot touch user memory unless it explicitly is enabled. In the kernel it should stay AMR_KUAP_BLOCKED. While returning to userspace just before RFI, kernel should restore the user AMR value back. Looks like GENERIC_ENTRY might be treating arch_exi

  2. Oct 15, 2026 · OpenSSF OSV / OSV Scanner

    Fix available

    Kernel fixed in 7.2.7

  3. Oct 15, 2026 · OpenSSF OSV / OSV Scanner

    Fix available

    Kernel fixed in 7.2.7

  4. Oct 15, 2026 · OpenSSF OSV / OSV Scanner

    Updated

    In the Linux kernel, the following vulnerability has been resolved: powerpc: Do not restore KUAP in arch_exit_to_user_mode_prepare() KUAP means kernel cannot touch user memory unless it explicitly is enabled. In the kernel it should stay AMR_KUAP_BLOCKED. While returning to userspace just before RFI, kernel should restore the user AMR value back. Looks like GENERIC_ENTRY might be treating arch_exi

Sources

  • CVE.orgVulnerability recordCVE-2026-98396

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-98396

    30-day exploitation probability 0.2%

    first.org
  • OpenSSF OSV / OSV ScannerPackage advisoryCVE-2026-98396

    powerpc: Do not restore KUAP in arch_exit_to_user_mode_prepare()

    osv.dev
  • Tenable CVE DatabaseVulnerability recordCVE-2026-98396

    In the Linux kernel, the following vulnerability has been resolved: powerpc: Do not restore KUAP in arch_exit_to_user_mode_prepare() KUAP means kernel cannot touch user memory unless it explicitly is enabled. In the kernel it should stay AMR_KUAP_BLOCKED. While returning to userspace just before RFI, kernel should restore the user AMR value back. Looks like GENERIC_ENTRY might be treating arch_exi

    tenable.com

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.