CVE-2026-98228
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
In the Linux kernel, for MIPS I6500 CPU cores, the CONFIG_WEAK_REORDERING_BEYOND_LLSC option is not selected when CONFIG_EYEQ is enabled. The lld/scd instructions on these cores do not provide ordering guarantees, so arch_cmpxchg() is not fully ordered. This can lead to kernel page faults and system crashes, as demonstrated in the oops report.
Risk Assessment
Organizations using systems based on MIPS I6500 (e.g., EyeQ5 platforms) are exposed to kernel instability, crashes, and potential data integrity issues due to incorrect ordering of atomic operations. An attacker could exploit this vulnerability to cause denial of service (DoS) or privilege escalation.
Recommendation
Immediately update the Linux kernel to a version containing the fix that forces CONFIG_WEAK_REORDERING_BEYOND_LLSC to be selected when CONFIG_EYEQ is enabled. If an update is not possible, consider manually enabling this option in the kernel configuration and rebuilding the system.
Other vulnerabilities in Linux kernel
See all- CVE-2026-99216Unknown
In the Linux kernel, the Hyper-V (hv) driver incorrectly forces the VMBus connection state to DISCONNECTED before calling vmbus_disconnect(). As a result, vmbus_initiate_unload() does not unload the connection because it only acts when the state is CONNECTED, so the Hyper-V host may continue sending messages or posting VMBus interrupts.
- CVE-2026-99215Unknown
In the Linux kernel power supply subsystem, a use-after-free vulnerability exists. If a power supply is unregistered while its external_power_changed() callback is still running, the driver may free data that the callback is still accessing, leading to a kernel crash (NULL pointer dereference).
- CVE-2026-99214Unknown
In the Linux kernel, the drm/vc4 HDMI driver has an ordering issue with Packet RAM enabling. When audio is triggered by the HPD handler before video is restored, vc4_hdmi_write_infoframe() may attempt to store an infoframe while Packet RAM is disabled, causing a kernel warning (splat). The fix moves Packet RAM enable/disable into the Runtime PM hooks.
- CVE-2026-99213Unknown
In the Linux kernel vsock subsystem, the TCP_ESTABLISHED to TCP_CLOSING transition on OP_RST can race with the connect loop. Resetting a socket still present in connected_table can lead to memory corruption, including a double list add and a kernel BUG.
- CVE-2026-99212Unknown
In the Linux kernel net/rds module, rds_rdma_cm_event_handler_cmn() returns the result of rdma_resolve_route() directly to rdma_cm on RDMA_CM_EVENT_ADDR_RESOLVED. A synchronous failure causes the id ic->i_cm_id to be destroyed while RDS still owns it, leading to use of a freed id during connection shutdown.
- CVE-2026-99211Unknown
In the Linux kernel netlink subsystem, socket filters can use SKF_NET_OFF and SKF_LL_OFF to read relative to an skb's network and MAC headers. Netlink producers may reserve headroom without resetting those headers, allowing a receiving socket's filter to read data before the initialized message and disclose memory contents.
- CVE-2026-99210Unknown
In the Linux kernel accel/rocket driver, rocket_probe() stores the return value of rocket_device_init() in the file-scoped rdev pointer before checking whether it is an error pointer. On failure rdev remains an ERR_PTR, and a later probe can skip initialization and dereference the error pointer when reading rdev->num_cores.
- CVE-2026-99209Unknown
In the Linux kernel drm/xe driver, xe_evict_flags() reads tbo->resource->mem_type, but a BO can reach eviction with no ttm.resource, e.g. an imported dma-buf whose resource was freed during teardown. This causes a NULL pointer dereference and a kernel fault.
- CVE-2026-99208Unknown
In the Linux kernel drm/xe/oa driver, ttm_bo_type_kernel BOs are not guaranteed to be zeroed on allocation and may contain data from previously freed pages. Since the OA buffer is mmap'able by userspace, this can expose stale kernel memory contents.
- CVE-2026-99207Unknown
In the Linux kernel's scsi: target subsystem, target_do_delayed_work() acquired delayed_cmd_lock with a plain spin_lock() without disabling interrupts, while all other acquisition sites use spin_lock_irqsave(). Since commands can now complete in interrupt context (complete_type=1 with direct_compl_supp), this can cause a deadlock when a completion arrives on the same CPU where the work item holds the lock.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: mips: select CONFIG_WEAK_REORDERING_BEYOND_LLSC from CONFIG_EYEQ On I6500 CPU cores, lld and scd give no ordering guarantees (same as all other instructions). To respect the assumption that arch_cmpxchg() is fully ordered, we must inject sync instructions above and below our lld/scd loops using the already in place WEAK_REORDERING_BEYOND_LLSC infrastructure. Otherwise, bad things can happen: [ 34.054496] CPU 3 Unable to handle kernel paging request at virtual address 0000000000000000, epc == a80000080838e01c, ra == a80000080838dfc4 [ 34.054559] Oops[#1]: [ 34.069561] CPU: 3 UID: 0 PID: 170 Comm: pipe_race Not tainted 7.2.0-rc6-01553-gb73c35220968-dirty #103 VOLUNTARY [ 34.079932] Hardware name: Mobile EyeQ5 MP5 Evaluation board [ 34.085592] $ 0 : 0000000000000000 0000000000000001 0000000000000000 0000000000000000 [ 34.093616] $ 4 : a800000808ee2618 000000000b7a879d 0000000000001000 0000000000000000 [ 34.101638] $ 8 : 0000000000e3f2c9 0000000000000000 a800000808a2a9f8 0000000000000000 [ 34.109660] $12 : a8000008139ffcd8 ffffffff84080018 a80000080837fae0 7878787878787878 [ 34.117682] $16 : a800000807e82940 0000000000001000 0000000000000000 0000000000000000 [ 34.125704] $20 : a800000802920e00 a8000008139ffdf8 a800000802649400 0000000000e3f2c9 [ 34.133726] $24 : 0000000000000006 00000001200406e0 [ 34.141783] $28 : a8000008139fc000 a8000008139ffd10 0000000000e3f2c8 a80000080838dfc4 [ 34.149837] epc : a80000080838e01c anon_pipe_read+0xd4/0x428 [ 34.155697] ra : a80000080838dfc4 anon_pipe_read+0x7c/0x428 [ 34.161549] Status: 140000e3 KX SX UX KERNEL EXL IE [ 34.166551] Cause : 40800408 (ExcCode 02) [ 34.170574] BadVA : 0000000000000000 [ 34.174161] PrId : 0001b028 (MIPS I6500) [ 34.178183] Process pipe_race (pid: 170, threadinfo=000000005ca35720, task=00000000e1013890, tls=000000014ebbb780) [ 34.188568] Stack : a800000802649400 0000000000000000 0000000000000000 a8000008139ffdd0 [ 34.196623] 0000000000000fba a800000808ee0000 0000000000000001 a8000008130c3e80 [ 34.204676] a8000008080d1280 a8000008139ffd58 a8000008139ffd58 1dbd2b22ea1dd500 [ 34.212729] a800000802649400 a800000808ee0000 ffffffffffffffea 0000000000000001 [ 34.220783] 0000000000001000 0000000000000000 00000001200ae518 ffffffffffffffff [ 34.228836] 000000fffbe0e530 a80000080837edf4 000000fffbe0e530 0000000000000000 [ 34.236890] 0000000000000000 0000000000000000 000000014ebb55a0 0000000000001000 [ 34.244943] 0000000000000001 a800000802649400 0000000000000000 0000000000000000 [ 34.252996] 0000000000000000 0000400400000000 0000000000000000 1dbd2b22ea1dd500 [ 34.261049] 00000000140000e3 a800000802649400 a800000802649400 a800000808ee0000 [ 34.269103] ... [ 34.271568] Call Trace: [ 34.274026] [<a80000080838e01c>] anon_pipe_read+0xd4/0x428 [ 34.279533] [<a80000080837edf4>] vfs_read+0x25c/0x318 [ 34.284607] [<a80000080837faac>] ksys_read+0x104/0x138 [ 34.289763] [<a80000080802b9cc>] syscall_common+0x44/0x68 [ 34.295187] [ 34.296689] Code: f84000cf 02209825 de020010 <dc420000> d8400004 02002825 0040f809 02802025 f84000c3 [ 34.306504] [ 34.308099] ---[ end trace 0000000000000000 ]--- My initial reproducer was the xdp-tools test suite. A standalone reproducer would be an lld/scd loop that, when the read is reordered by the CPU, triggers a fault. We can achieve this from userspace by stressing an anonymous pipe, which uses a mutex. Program used: // SPDX-License-Identifier: GPL-2.0 // pipe_race.c - reproducer for MIPS LL/SC reordering vs fs/pipe.c // // Two userspace processes on an anonymous pipe: // parent = writer: tight write() loop // child = reader: tight read() loop #define _GNU_SOURCE #include <assert.h> #include <errno.h> #include <sched.h> #include <signal.h> #include <stdio.h> #include <stdlib.h> #include <string.h> #include <sys/types.h> #include ---truncated---
Vulnerability data from NVD (NIST) · CISA KEV · EPSS