CVE-2026-98396 in Linux
Summary
by MITRE • 10/14/2026
In the Linux kernel, the following vulnerability has been resolved:
powerpc: Do not restore KUAP in arch_exit_to_user_mode_prepare()
KUAP means kernel cannot touch user memory unless it explicitly is enabled. In the kernel it should stay AMR_KUAP_BLOCKED. While returning to userspace just before RFI, kernel should restore the user AMR value back.
Looks like GENERIC_ENTRY might be treating arch_exit_to_user_mode_prepare() as the last architecture step before returning to userspace. commit bee25f97ad24 ("powerpc: Enable GENERIC_ENTRY feature") therefore called kuap_user_restore() from that hook. But on PowerPC that is too early. After irqentry_exit() / syscall_exit_to_user_mode() we still run platform specific exit routines.
e.g. code snippets showing both exception handling and system call handling as the callers of function arch_exit_to_user_mode_prepare() which does kuap_user_restore(). The below path shows that calling kuap_user_restore() is too early when called from arch_exit_to_user_mode_prepare().
Exception handling in exceptions-64s.S =======================================
bl CFUNC(do_page_fault) ..DEFINE_INTERRUPT_HANDLER_ASYNC(do_page_fault) arch_interrupt_async_enter_prepare(regs); state = irqentry_enter(regs); instrumentation_begin(); irq_enter_rcu(); handler(regs); nap_adjust_return(regs); irq_exit_rcu(); instrumentation_end(); arch_interrupt_async_exit_prepare(regs); irqentry_exit(regs, state); <<< too early irqentry_exit_to_user_mode() __exit_to_user_mode_prepare(regs, EXIT_TO_USER_MODE_WORK_IRQ); arch_exit_to_user_mode_prepare(regs, ti_work); <<< too early b interrupt_return_srr .. bl CFUNC(interrupt_exit_user_prepare) <<< already calls kuap_user_restore
prep_irq_for_enabled_exit() retry can run kernel code with IRQs on. So only when that routine is fully finished is when the user KUAP should be fully restored which interrupt_exit_user_prepare() already takes care of before returning.
Similarly for system call handling in interrupt_64.S ======================================================
bl CFUNC(system_call_exception)
.Lsyscall_exit: addi r4,r1,STACK_INT_FRAME_REGS li r5,0 /* !scv */ bl CFUNC(syscall_exit_prepare) .. kuap_assert_locked(); syscall_exit_to_user_mode(regs); <<< too early syscall_exit_to_user_mode_prepare(regs); <<< too early kuap_user_restore(regs); <<< already calls
syscall_exit_prepare(), which can enable IRQs, replay a pending interrupt, and only then rfi. Those functions already restore KUAP immediately before rfi.
Note that if we restore the user AMR too early like in the current code as shown from the code snippets above, then we get the following warning when CONFIG_PPC_KUAP_DEBUG is enabled: WARNING: arch/powerpc/include/asm/book3s/64/kup.h:293 at interrupt_exit_user_prepare+0x1a0/0x1c0 Hardware name: IBM pSeries (emulated by qemu) POWER10 (architected) TRAP: 0700 LR: c00000000000d8d4 CTR: c0000000021fe500 MSR: <SF,EE,ME,IR,DR,RI,LE> CR: 44000804 XER: 20040000 interrupt_exit_user_prepare+0x1a0/0x1c0 interrupt_return_srr_user+0x8/0x12c
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The Linux kernel for PowerPC architectures contains a critical logic error in the handling of Kernel User Access Protection, commonly referred to as KUAP. This vulnerability stems from an incorrect placement of the function call responsible for restoring user-mode access rights during the transition back to userspace. The core issue lies within the arch_exit_to_user_mode_prepare() hook, which was erroneously configured by the GENERIC_ENTRY feature implementation to invoke kuap_user_restore(). This restoration process is intended to reset the Access Mode Register (AMR) to its blocked state for user memory access immediately before returning control from kernel mode to user space. However, executing this restore too early in the exit sequence leaves a window where the kernel retains elevated privileges while still performing platform-specific cleanup or handling pending interrupts, thereby violating the fundamental security principle of least privilege and exposing the system to potential exploitation vectors associated with unauthorized memory access.
KUAP is a hardware-enforced mechanism on PowerPC processors that prevents the kernel from accessing user-space memory unless explicitly enabled via specific instructions. Under normal operation, the AMR should remain in a blocked state (AMR_KUAP_BLOCKED) while executing within the kernel to ensure isolation between privileged and unprivileged code. The vulnerability arises because the GENERIC_ENTRY refactoring assumed that arch_exit_to_user_mode_prepare() represents the final architectural step before returning to userspace. Consequently, it placed the kuap_user_restore() call at this stage. In reality, on PowerPC platforms, there are subsequent platform-specific exit routines executed after irqentry_exit or syscall_exit paths complete their primary work but before the actual Return From Interrupt (RFI) instruction is issued. This timing mismatch means that for a brief period during these final cleanup phases, the kernel operates with user access permissions enabled when it should not be.
The operational impact of this flaw is significant in scenarios where interrupt handling or system call exits involve re-enabling interrupts to process pending events. For instance, in exception handling paths defined in exceptions-64s.S, after arch_interrupt_async_exit_prepare and irqentry_exit are called, the code may enter a retry loop via prep_irq_for_enabled_exit that runs kernel code with interrupts enabled. Similarly, system call exits in interrupt_64.S involve syscall_exit_to_user_mode which can enable IRQs to replay pending interrupts before issuing an RFI. During these intervals where interrupts are active and kernel execution continues, the premature restoration of user access rights means the kernel is vulnerable to accessing or modifying user memory that it should be strictly prohibited from touching. This creates a potential side-channel for information disclosure or privilege escalation if malicious code can trigger specific race conditions or exploit timing windows within this window.
Debugging efforts have confirmed the presence of this flaw through explicit warnings generated when CONFIG_PPC_KUAP_DEBUG is enabled. The kernel emits a warning trace pointing to interrupt_exit_user_prepare, indicating that hardware protection checks are failing because KUAP was already restored earlier than intended. This debug output highlights the discrepancy between the expected state and the actual state during the exit sequence. If left unpatched, this vulnerability undermines the integrity of memory isolation on PowerPC systems. Attackers could potentially leverage this misconfiguration to read sensitive data from user processes or corrupt kernel structures by exploiting the brief period where access controls are incorrectly relaxed during complex interrupt handling scenarios.
To mitigate this vulnerability, the fix involves removing the kuap_user_restore() call from arch_exit_to_user_mode_prepare(). Instead, the restoration of KUAP must be deferred until it is strictly necessary and safe to do so. The correct location for restoring user access rights is within platform-specific exit routines such as interrupt_exit_user_prepare in exception handling or directly before the RFI instruction in system call exits. These locations ensure that all pending interrupts have been processed, any retry loops involving enabled interrupts are complete, and no further kernel code will execute with elevated privileges before returning to userspace. This adjustment aligns the KUAP enforcement mechanism with the actual execution flow of PowerPC exit paths, ensuring that user memory access remains blocked until the very last moment possible.
From a classification perspective, this vulnerability is best categorized under CWE-20: Improper Input Validation or more specifically CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition within the context of privilege management. It represents a failure to maintain security controls during state transitions, which can also be mapped to MITRE ATT&CK techniques related to Defense Evasion and Privilege Escalation, particularly those involving kernel exploitation or memory corruption via race conditions. The resolution ensures that the powerpc architecture adheres strictly to its own hardware protection models, preventing any ambiguity in when user access permissions are granted or revoked during context switches. This patch is essential for maintaining the security posture of PowerPC-based Linux systems against sophisticated attacks targeting kernel-user boundary enforcement mechanisms.