CVE-2026-98396

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

powerpc: Do not restore KUAP in arch_exit_to_user_mode_prepare()

KUAP means kernel cannot touch user memory unless it explicitly is

enabled. In the kernel it should stay AMR_KUAP_BLOCKED. While returning

to userspace just before RFI, kernel should restore the user AMR value

back.

Looks like GENERIC_ENTRY might be treating arch_exit_to_user_mode_prepare()

as the last architecture step before returning to userspace.

commit bee25f97ad24 ("powerpc: Enable GENERIC_ENTRY feature")

therefore called kuap_user_restore() from that hook. But on PowerPC that

is too early. After irqentry_exit() / syscall_exit_to_user_mode() we

still run platform specific exit routines.

e.g. code snippets showing both exception handling and system call

handling as the callers of function arch_exit_to_user_mode_prepare()

which does kuap_user_restore(). The below path shows that calling

kuap_user_restore() is too early when called from

arch_exit_t

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References