CVE-2026-90212

A flaw was found in the Linux kernel's arm64 EFI (Extensible Firmware Interface) implementation. When software PAN (Privileged Access Never) is enabled, the system can experience a bad kernel memory access. This occurs due to incorrect handling of the TTBR0_EL1 register during voluntary preemption within the fpsimd context management code. A local attacker or specific system conditions could trigger this, leading to a kernel crash and a denial of service.

A moderate severity denial-of-service flaw was found in the Linux kernel's arm64 EFI runtime services implementation. On arm64 systems built with software PAN (CONFIG_ARM64_SW_TTBR0_PAN=y) that support EFI runtime services, the fpsimd context management code called from __efi_fpsimd_begin() can voluntarily preempt after the EFI page tables (efi_mm) have been installed. Because the software PAN implementation uses deferred mm switching, execution can return to the EFI runtime services code with an incorrect value for TTBR0_EL1, causing a bad kernel memory access (a level 0 translation fault) that leads to a kernel oops or panic and a denial of service. A local attacker, or specific system conditions that invoke EFI runtime services within this window, can crash the system. Red Hat rates this MODERATE impact with CVSS 3.1 score 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H); there is no confidentiality or integrity impact, only availability.

Red Hat Enterprise Linux 10.3 and 10.4, and Red Hat In-Vehicle OS 2.0 and 2.1 (kernel and kernel-ivos-qualcomm components), are affected because they contain the code that calls EFI runtime services without disabling preemption. For these affected streams the fix is deferred, and the residual risk is a local denial of service (kernel panic) on arm64 systems with software PAN enabled; the upstream fix reorders the fpsimd context switch so that it occurs before the page-table switch to efi_mm. Earlier Red Hat Enterprise Linux versions and streams, and OpenShift Container Platform releases, are not affected because the vulnerable code is not present in their kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.