CVE-2026-98396

In the Linux kernel, the following vulnerability has been resolved:

powerpc: Do not restore KUAP in arch exit to user mode prepare()

KUAP means kernel cannot touch user memory unless it explicitly is enabled. In the kernel it should stay AMR KUAP BLOCKED. While returning to userspace just before RFI, kernel should restore the user AMR value back.

Looks like GENERIC ENTRY might be treating arch exit to user mode prepare() as the last architecture step before returning to userspace. commit bee25f97ad24 ("powerpc: Enable GENERIC ENTRY feature") therefore called kuap user restore() from that hook. But on PowerPC that is too early. After irqentry exit() / syscall exit to user mode() we still run platform specific exit routines.

e.g. code snippets showing both exception handling and system call handling as the callers of function arch exit to user mode prepare() which does kuap user restore(). The below path shows that calling kuap user restore() is too early when called from arch exit to user mode prepare().

bl CFUNC(do page fault) ..DEFINE INTERRUPT HANDLER ASYNC(do page fault) arch interrupt async enter prepare(regs); state = irqentry enter(regs); instrumentation begin(); irq enter rcu(); handler(regs); nap adjust return(regs); irq exit rcu(); instrumentation end(); arch interrupt async exit prepare(regs); irqentry exit(regs, state); <<< too early irqentry exit to user mode() exit to user mode prepare(regs, EXIT TO USER MODE WORK IRQ); arch exit to user mode prepare(regs, ti work); <<< too early b interrupt return srr .. bl CFUNC(interrupt exit user prepare) <<< already calls kuap user restore

prep irq for enabled exit() retry can run kernel code with IRQs on. So only when that routine is fully finished is when the user KUAP should be fully restored which interrupt exit user prepare() already takes care of before returning.

bl	CFUNC(system call exception)

.Lsyscall exit: addi r4,r1,STACK INT FRAME REGS li r5,0 /* !scv */ bl CFUNC(syscall exit prepare) .. kuap assert locked(); syscall exit to user mode(regs); <<< too early syscall exit to user mode prepare(regs); <<< too early kuap user restore(regs); <<< already calls

syscall exit prepare(), which can enable IRQs, replay a pending interrupt, and only then rfi. Those functions already restore KUAP immediately before rfi.

Note that if we restore the user AMR too early like in the current code as shown from the code snippets above, then we get the following warning when CONFIG PPC KUAP DEBUG is enabled: WARNING: arch/powerpc/include/asm/book3s/64/kup.h:293 at interrupt exit user prepare+0x1a0/0x1c0 Hardware name: IBM pSeries (emulated by qemu) POWER10 (architected) TRAP: 0700 LR: c00000000000d8d4 CTR: c0000000021fe500 MSR: <SF,EE,ME,IR,DR,RI,LE> CR: 44000804 XER: 20040000 interrupt exit user prepare+0x1a0/0x1c0 interrupt return srr user+0x8/0x12c