CVE-2026-93260

A flaw was found in the Linux kernel. When initialization of inter-processor interrupts fails within the PowerPC External Interrupt Virtualization Engine (XIVE), the system ignores the failure after freeing allocated memory structures. This leads to a use-after-free condition when subsequent setup code attempts to access the released data, resulting in memory corruption. An attacker or environment triggering an allocation failure could exploit this flaw to cause a Denial of Service (DoS) via a system crash or potentially execute arbitrary code.

This vulnerability is evaluated as having Moderate impact because it is confined to PowerPC environments using the External Interrupt Virtualization Engine (XIVE) and can only trigger if resource exhaustion occurs during early boot initialization. The resulting use-after-free primarily produces a kernel crash during system startup, limiting the blast radius to a denial of service without exposing sensitive information or enabling privilege escalation. Deployments on non-PowerPC hardware architectures (such as x86_64, aarch64, and s390x) do not incorporate this interrupt controller subsystem and are unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.