CVE-2026-89589

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

acpi/apei/ghes: Use raw_spinlock_t for CXL CPER work locks

The CXL CPER work registration and unregistration helpers acquire

cxl_cper_work_lock and cxl_cper_prot_err_work_lock with a spinlock

guard(), which leaves local interrupts enabled. The corresponding post

paths (cxl_cper_post_event(), cxl_cper_post_prot_err()) execute in hard

IRQ context (they are called from the GHES error notification path) and

acquire the same locks with an irqsave guard().

If a CPU is holding one of these locks via a spinlock guard() when a GHES

interrupt arrives on the same CPU, the IRQ handler spins on the held lock

waiting for it to release, while the lock holder is preempted by the IRQ.

The result is a deadlock.

Convert both locks from spinlock_t to raw_spinlock_t and use guard() at

all call sites. On PREEMPT_RT kernels spinlock_t is backed by rt_mutex and

sleeping from hard IRQ context is not permitted; raw_spinlock_t is safe in

bot

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References