Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-80626— powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel 2.6.34版本存在安全漏洞，该漏洞源于powerpc/perf的fsl_emb_pmu_del函数中put_cpu_var与get_cpu_var调用不匹配，当event->hw.idx为负数时跳转未获取cpu变量却执行释放操作，导致preempt count下溢，可能使内核出现“scheduling while atomic”错误。

AI Predicted 5.1 Difficulty: Hard EPSS 0.22% · P12

Possible ATT&CK Techniques 1 AI

T1200 · Hardware Additions

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux a11106544f33c104706ae42d27219a409b67478e< c0c7722308c5f303117d8bd555290fdf26b098da affected
a11106544f33c104706ae42d27219a409b67478e< 67aeb1eb93d4ffd898a3e74a7f3fe46ee71feb28 affected
a11106544f33c104706ae42d27219a409b67478e< 9a515e00b00132b6fc3f1dd62dc5204bbda8cb10 affected
a11106544f33c104706ae42d27219a409b67478e< 5397142d60aa29dcf636f5459d960bfc4f97c42a affected
a11106544f33c104706ae42d27219a409b67478e< b89477077c834d94381c7bf07d81193bebefcff9 affected
a11106544f33c104706ae42d27219a409b67478e< 73711688479df333acc134e3730fff1acba1843e affected
a11106544f33c104706ae42d27219a409b67478e< b504fd953664c3f4d176ae8cb594adb3fda9d577 affected
a11106544f33c104706ae42d27219a409b67478e< 81e3a86030462824a67d697739cf3f387f4ba350 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-80626

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del fsl_emb_pmu_del() unconditionally calls put_cpu_var(cpu_hw_events) at the 'out:' label, but only calls the matching get_cpu_var() after the 'i < 0' early-return check. When event->hw.idx is negative the function jumps to 'out:' without having taken get_cpu_var(), and the trailing put_cpu_var() then issues an unmatched preempt_enable(), underflowing preempt_count. On a CONFIG_PREEMPT=y kernel preempt_count would underflow and eventually present as a 'scheduling while atomic' BUG. Move put_cpu_var() to pair with get_cpu_var() so the percpu access is correctly bracketed and the 'out:' label only handles perf_pmu_enable.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel 2.6.34版本存在安全漏洞，该漏洞源于powerpc/perf的fsl_emb_pmu_del函数中put_cpu_var与get_cpu_var调用不匹配，当event->hw.idx为负数时跳转未获取cpu变量却执行释放操作，导致preempt count下溢，可能使内核出现“scheduling while atomic”错误。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux a11106544f33c104706ae42d27219a409b67478e ~ c0c7722308c5f303117d8bd555290fdf26b098da -
Linux Linux 2.6.34 -

II. Public POCs for CVE-2026-80626

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-80626

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-80626 (8)

Same Patch Batch · Linux · 2026-08-28 · 135 CVEs total

CVE-2026-80634 9.8 CRITICAL netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag
CVE-2026-80694 9.8 CRITICAL net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller
CVE-2026-80681 9.8 CRITICAL vxlan: re-fetch eth header after route_shortcircuit()
CVE-2026-80674 9.8 CRITICAL ntfs: validate resident attribute lists and harden the validator
CVE-2026-80673 9.8 CRITICAL ntfs: bound the look-ahead attribute-list entry in ntfs_external_attr_find()
CVE-2026-80668 9.8 CRITICAL netfilter: nf_conntrack_expect: use conntrack GC to reap expectations
CVE-2026-80630 9.8 CRITICAL net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restorin
CVE-2026-80617 9.8 CRITICAL net: airoha: fix foe_check_time allocation size
CVE-2026-80612 9.8 CRITICAL net: lwtunnel: Drop skb metadata before LWT encapsulation
CVE-2026-80714 9.8 CRITICAL ipvs: do not propagate one-packet flag to synced conns
CVE-2026-80609 9.8 CRITICAL qede: fix out-of-bounds check for cqe->len_list[]
CVE-2026-80600 9.8 CRITICAL batman-adv: dat: acquire ARP hw source only after skb realloc
CVE-2026-80693 9.3 CRITICAL idpf: bound interrupt-vector register fill to the allocated array
CVE-2026-80684 9.3 CRITICAL KVM: s390: pci: Fix NULL dereference on AIBV allocation failure
CVE-2026-80671 9.3 CRITICAL perf sched: Fix register_pid() overflow, strcpy, and BUG_ON
CVE-2026-80603 9.1 CRITICAL netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read
CVE-2026-80670 9.1 CRITICAL perf tools: Use perf_env__get_cpu_topology() in machine__resolve()
CVE-2026-80721 8.8 HIGH Bluetooth: ISO: ensure no dangling hcon references in iso_conn
CVE-2026-80722 8.8 HIGH wifi: mac80211: validate individual TWT params before driver setup
CVE-2026-80724 8.8 HIGH ptp: vmclock: prevent read-only mappings from becoming writable

Showing top 20 of 135 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-80626

No comments yet

Leave a comment