# CVE-2026-98395: linux: In the Linux kernel, the following vulnerability has been resolved:  powerpc/entry: Fix irq_soft_mask corruption on r...

CVE-2026-98395 is fixed in linux on 1 platform by DEBIAN-CVE-2026-98395 (version 7.2.7-1), released October 16, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-98395
- Priority: Routine
- CVSS: n/a
- EPSS: 0.0019
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Oct 14, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:  powerpc/entry: Fix irq_soft_mask corruption on replayed interrupt exit  When __replay_soft_interrupts() replays a pending interrupt (e.g. PACA_IRQ_DEC -> timer_interrupt), it calls the handler directly with a synthetic pt_regs. The DEFINE_INTERRUPT_HANDLER_ASYNC wrapper around each handler calls arch_interrupt_async_exit_prepare() on the way out, which calls arch_interrupt_exit_prepare() -> local_irq_disable() -> arch_local_irq_disable(), which does:      irq_soft_mask_set(IRQS_DISABLED)   /* 0x1 */  This unconditionally overwrites irq_soft_mask with IRQS_DISABLED (0x1), stripping the IRQS_PMI_DISABLED (0x2) bit. The result is that irq_soft_mask is 0x1 instead of IRQS_ALL_DISABLED (0x3) when the handler returns to __replay_soft_interrupts().  For a normally-taken interrupt this is harmless: the next interrupt always enters through arch_interrupt_enter_prepare() which unconditionally sets irq_soft_mask to IRQS_ALL_DISABLED. But during replay, next_interrupt() is called directly between replayed handlers without going back through arch_interrupt_enter_prepare(), so the stripped bit is never restored. next_interrupt() then fires a WARNING:      WARNING: arch/powerpc/kernel/irq_64.c:75     WARN_ON(irq_soft_mask_return() != IRQS_ALL_DISABLED)  The warning was observed early in boot on a POWER10 pseries guest during kmem_cache_init_late(), where a spinlock release triggers interrupt replay that processes a pending timer interrupt.  Debugger state confirming the bug:   Before timer_interrupt(&regs):     irq_soft_mask = 0x3 (IRQS_ALL_DISABLED)   correct     irq_happened  = 0x41 (HARD_DIS|REPLAYING)  correct   After timer_interrupt(&regs) returns:     irq_soft_mask = 0x1 (IRQS_DISABLED)        WRONG - PMI bit stripped     irq_happened  = 0x41                        unchanged  The fix is to replace local_irq_disable() with hard_irq_disable().  hard_irq_disable() is the right primitive here for two reasons:  1. On PPC64 (hw_irq.h:301) it calls irq_soft_mask_set_return(IRQS_ALL_DISABLED),    setting the soft mask to 0x3 (both IRQS_DISABLED and IRQS_PMI_DISABLED),    which preserves the PMI bit and fixes the WARNING. The additional    work it does (__hard_irq_disable(), PACA_IRQ_HARD_DIS |=) is    redundant but safe since both are already set at this point in the    exit path; the trace_hardirqs_off() inside is guarded by    if (!arch_irqs_disabled_flags(flags)) so it will not double-fire.  2. On PPC32 (hw_irq.h:467) hard_irq_disable() maps to    arch_local_irq_disable() -> __hard_irq_disable(), which clears    MSR[EE] in hardware. This is exactly correct: PPC32 has no soft-mask    PACA mechanism, so the hardware disable is the right way to satisfy    irqentry_exit()'s requirement. This also fixes a build error on PPC32    where irq_soft_mask_set() is only defined under CONFIG_PPC64:         arch/powerpc/include/asm/entry-common.h:273: error: implicit        declaration of function 'irq_soft_mask_set'     Using hard_irq_disable() requires no #ifdef and is consistent with    how the rest of the entry code (e.g. entry-common.h:463) handles the    same PPC32/PPC64 split.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 14 | 7.2.7-1 | [DEBIAN-CVE-2026-98395](https://patchblox.com/security/data/fix/linux/debian-cve-2026-98395.md) | Oct 16, 2026 |

---

Data as of 2026-11-09T01:18:40Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.