CVE-2026-72154

A flaw was found in the Linux kernel, specifically within the OpenRISC architecture's handling of jump label synchronization in Symmetric Multiprocessing (SMP) systems. The implementation did not correctly invalidate instruction caches (icaches) on remote processor cores after updates. This oversight can lead to stale static key code sequences persisting in the icache, resulting in coherency issues and potentially incorrect program execution.

A moderate-severity flaw was found in the Linux kernel's OpenRISC architecture-specific jump label (static key) SMP synchronization code. When a static key is updated on an OpenRISC SMP system, the kernel relied on kick_all_cpus_sync(), which does not correctly invalidate the instruction caches (icaches) of remote CPU cores on OpenRISC. As a result, stale static key code sequences could persist in the icaches of remote cores, breaking instruction cache coherency and potentially causing incorrect kernel code execution, system instability, or denial of service. Red Hat rated this flaw Moderate severity with a CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), lower than the CVE.org score of 7.8, because Red Hat assessed the impact as limited to availability with no direct confidentiality or integrity impact. All Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel streams are marked NOT AFFECTED with the justification "Vulnerable Code not Present": the flawed jump label synchronization code is specific to the OpenRISC architecture, which is not present in the kernels Red Hat ships and supports.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.