Vulnerability-Lookup

FKIE_CVE-2025-71078

Vulnerability from fkie_nvd - Published: 2026-01-13 16:16 - Updated: 2026-10-19 19:17

Severity

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: powerpc/64s/slb: Fix SLB multihit issue during SLB preload On systems using the hash MMU, there is a software SLB preload cache that mirrors the entries loaded into the hardware SLB buffer. This preload cache is subject to periodic eviction — typically after every 256 context switches — to remove old entry. To optimize performance, the kernel skips switch_mmu_context() in switch_mm_irqs_off() when the prev and next mm_struct are the same. However, on hash MMU systems, this can lead to inconsistencies between the hardware SLB and the software preload cache. If an SLB entry for a process is evicted from the software cache on one CPU, and the same process later runs on another CPU without executing switch_mmu_context(), the hardware SLB may retain stale entries. If the kernel then attempts to reload that entry, it can trigger an SLB multi-hit error. The following timeline shows how stale SLB entries are created and can cause a multi-hit error when a process moves between CPUs without a MMU context switch. CPU 0 CPU 1 ----- ----- Process P exec swapper/1 load_elf_binary begin_new_exc activate_mm switch_mm_irqs_off switch_mmu_context switch_slb /* * This invalidates all * the entries in the HW * and setup the new HW * SLB entries as per the * preload cache. */ context_switch sched_migrate_task migrates process P to cpu-1 Process swapper/0 context switch (to process P) (uses mm_struct of Process P) switch_mm_irqs_off() switch_slb load_slb++ /* * load_slb becomes 0 here * and we evict an entry from * the preload cache with * preload_age(). We still * keep HW SLB and preload * cache in sync, that is * because all HW SLB entries * anyways gets evicted in * switch_slb during SLBIA. * We then only add those * entries back in HW SLB, * which are currently * present in preload_cache * (after eviction). */ load_elf_binary continues... setup_new_exec() slb_setup_new_exec() sched_switch event sched_migrate_task migrates process P to cpu-0 context_switch from swapper/0 to Process P switch_mm_irqs_off() /* * Since both prev and next mm struct are same we don't call * switch_mmu_context(). This will cause the HW SLB and SW preload * cache to go out of sync in preload_new_slb_context. Because there * was an SLB entry which was evicted from both HW and preload cache * on cpu-1. Now later in preload_new_slb_context(), when we will try * to add the same preload entry again, we will add this to the SW * preload cache and then will add it to the HW SLB. Since on cpu-0 * this entry was never invalidated, hence adding this entry to the HW * SLB will cause a SLB multi-hit error. */ load_elf_binary cont ---truncated---

References

URL	Tags
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/00312419f0863964625d6dcda8183f96849412c6	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/01324c0328181b94cf390bda22ff91c75126ea57	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/2e9a95d60f1df7b57618fd5ef057aef331575bd2	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/4ae1e46d8a290319f33f71a2710a1382ba5431e8	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/895123c309a34d2cfccf7812b41e17261a3a6f37	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/b13a3dbfa196af68eae2031f209743735ad416bf	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/c9f865022a1823d814032a09906e91e4701a35fc	Patch

Impacted products

Vendor	Product	Version
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	*
linux	linux_kernel	4.20
linux	linux_kernel	6.19
linux	linux_kernel	6.19
linux	linux_kernel	6.19
linux	linux_kernel	6.19
linux	linux_kernel	6.19
linux	linux_kernel	6.19
linux	linux_kernel	6.19
linux	linux_kernel	6.19

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/powerpc/include/asm/book3s/64/mmu-hash.h",
            "arch/powerpc/kernel/process.c",
            "arch/powerpc/mm/book3s64/internal.h",
            "arch/powerpc/mm/book3s64/mmu_context.c",
            "arch/powerpc/mm/book3s64/slb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "01324c0328181b94cf390bda22ff91c75126ea57",
              "status": "affected",
              "version": "5434ae74629af58ad0fc27143a9ea435f7734410",
              "versionType": "git"
            },
            {
              "lessThan": "2e9a95d60f1df7b57618fd5ef057aef331575bd2",
              "status": "affected",
              "version": "5434ae74629af58ad0fc27143a9ea435f7734410",
              "versionType": "git"
            },
            {
              "lessThan": "c9f865022a1823d814032a09906e91e4701a35fc",
              "status": "affected",
              "version": "5434ae74629af58ad0fc27143a9ea435f7734410",
              "versionType": "git"
            },
            {
              "lessThan": "b13a3dbfa196af68eae2031f209743735ad416bf",
              "status": "affected",
              "version": "5434ae74629af58ad0fc27143a9ea435f7734410",
              "versionType": "git"
            },
            {
              "lessThan": "895123c309a34d2cfccf7812b41e17261a3a6f37",
              "status": "affected",
              "version": "5434ae74629af58ad0fc27143a9ea435f7734410",
              "versionType": "git"
            },
            {
              "lessThan": "4ae1e46d8a290319f33f71a2710a1382ba5431e8",
              "status": "affected",
              "version": "5434ae74629af58ad0fc27143a9ea435f7734410",
              "versionType": "git"
            },
            {
              "lessThan": "00312419f0863964625d6dcda8183f96849412c6",
              "status": "affected",
              "version": "5434ae74629af58ad0fc27143a9ea435f7734410",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/powerpc/include/asm/book3s/64/mmu-hash.h",
            "arch/powerpc/kernel/process.c",
            "arch/powerpc/mm/book3s64/internal.h",
            "arch/powerpc/mm/book3s64/mmu_context.c",
            "arch/powerpc/mm/book3s64/slb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "lessThan": "4.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.248",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.198",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.64",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C44CF837-66F6-42EA-913D-E183A8A6346F",
              "versionEndExcluding": "5.10.248",
              "versionStartIncluding": "4.20.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "82159CAA-B6BA-43C6-85D8-65BDBC175A7E",
              "versionEndExcluding": "5.15.198",
              "versionStartIncluding": "5.11",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C10CC03E-16A9-428A-B449-40D3763E15F6",
              "versionEndExcluding": "6.1.160",
              "versionStartIncluding": "5.16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "43C3A206-5EEE-417B-AA0F-EF8972E7A9F0",
              "versionEndExcluding": "6.6.120",
              "versionStartIncluding": "6.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "32BF4A52-377C-44ED-B5E6-7EA5D896E98B",
              "versionEndExcluding": "6.12.64",
              "versionStartIncluding": "6.7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "DC988EA0-0E32-457A-BF95-89BEB31A227B",
              "versionEndExcluding": "6.18.4",
              "versionStartIncluding": "6.13",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:4.20:-:*:*:*:*:*:*",
              "matchCriteriaId": "1072305B-94A8-4D68-9419-B786885AA310",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "17B67AA7-40D6-4AFA-8459-F200F3D7CFD1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "C47E4CC9-C826-4FA9-B014-7FE3D9B318B2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*",
              "matchCriteriaId": "F71D92C0-C023-48BD-B3B6-70B638EEE298",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*",
              "matchCriteriaId": "13580667-0A98-40CC-B29F-D12790B91BDB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*",
              "matchCriteriaId": "CAD1FED7-CF48-47BF-AC7D-7B6FA3C065FC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*",
              "matchCriteriaId": "3EF854A1-ABB1-4E93-BE9A-44569EC76C0D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*",
              "matchCriteriaId": "F5DC0CA6-F0AF-4DDF-A882-3DADB9A886A7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc8:*:*:*:*:*:*",
              "matchCriteriaId": "EB5B7DFC-C36B-45D8-922C-877569FDDF43",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/64s/slb: Fix SLB multihit issue during SLB preload\n\nOn systems using the hash MMU, there is a software SLB preload cache that\nmirrors the entries loaded into the hardware SLB buffer. This preload\ncache is subject to periodic eviction \u2014 typically after every 256 context\nswitches \u2014 to remove old entry.\n\nTo optimize performance, the kernel skips switch_mmu_context() in\nswitch_mm_irqs_off() when the prev and next mm_struct are the same.\nHowever, on hash MMU systems, this can lead to inconsistencies between\nthe hardware SLB and the software preload cache.\n\nIf an SLB entry for a process is evicted from the software cache on one\nCPU, and the same process later runs on another CPU without executing\nswitch_mmu_context(), the hardware SLB may retain stale entries. If the\nkernel then attempts to reload that entry, it can trigger an SLB\nmulti-hit error.\n\nThe following timeline shows how stale SLB entries are created and can\ncause a multi-hit error when a process moves between CPUs without a\nMMU context switch.\n\nCPU 0                                   CPU 1\n-----                                    -----\nProcess P\nexec                                    swapper/1\n load_elf_binary\n  begin_new_exc\n    activate_mm\n     switch_mm_irqs_off\n      switch_mmu_context\n       switch_slb\n       /*\n        * This invalidates all\n        * the entries in the HW\n        * and setup the new HW\n        * SLB entries as per the\n        * preload cache.\n        */\ncontext_switch\nsched_migrate_task migrates process P to cpu-1\n\nProcess swapper/0                       context switch (to process P)\n(uses mm_struct of Process P)           switch_mm_irqs_off()\n                                         switch_slb\n                                           load_slb++\n                                            /*\n                                            * load_slb becomes 0 here\n                                            * and we evict an entry from\n                                            * the preload cache with\n                                            * preload_age(). We still\n                                            * keep HW SLB and preload\n                                            * cache in sync, that is\n                                            * because all HW SLB entries\n                                            * anyways gets evicted in\n                                            * switch_slb during SLBIA.\n                                            * We then only add those\n                                            * entries back in HW SLB,\n                                            * which are currently\n                                            * present in preload_cache\n                                            * (after eviction).\n                                            */\n                                        load_elf_binary continues...\n                                         setup_new_exec()\n                                          slb_setup_new_exec()\n\n                                        sched_switch event\n                                        sched_migrate_task migrates\n                                        process P to cpu-0\n\ncontext_switch from swapper/0 to Process P\n switch_mm_irqs_off()\n  /*\n   * Since both prev and next mm struct are same we don\u0027t call\n   * switch_mmu_context(). This will cause the HW SLB and SW preload\n   * cache to go out of sync in preload_new_slb_context. Because there\n   * was an SLB entry which was evicted from both HW and preload cache\n   * on cpu-1. Now later in preload_new_slb_context(), when we will try\n   * to add the same preload entry again, we will add this to the SW\n   * preload cache and then will add it to the HW SLB. Since on cpu-0\n   * this entry was never invalidated, hence adding this entry to the HW\n   * SLB will cause a SLB multi-hit error.\n   */\nload_elf_binary cont\n---truncated---"
    }
  ],
  "id": "CVE-2025-71078",
  "lastModified": "2026-10-19T19:17:08.507",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-71078",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-10-16T15:05:39.588741Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-01-13T16:16:07.317",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/00312419f0863964625d6dcda8183f96849412c6"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/01324c0328181b94cf390bda22ff91c75126ea57"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/2e9a95d60f1df7b57618fd5ef057aef331575bd2"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/4ae1e46d8a290319f33f71a2710a1382ba5431e8"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/895123c309a34d2cfccf7812b41e17261a3a6f37"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/b13a3dbfa196af68eae2031f209743735ad416bf"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/c9f865022a1823d814032a09906e91e4701a35fc"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-362"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

CVE-2025-71078 (GCVE-0-2025-71078)

Vulnerability from cvelistv5 – Published: 2026-01-13 15:34 – Updated: 2026-10-19 18:15

Title

powerpc/64s/slb: Fix SLB multihit issue during SLB preload

Summary

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 15:05 UTC

CWE

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6639 records in the last 180 days details

References

7 references

URL	Tags
https://git.kernel.org/stable/c/01324c0328181b94c…
https://git.kernel.org/stable/c/2e9a95d60f1df7b57…
https://git.kernel.org/stable/c/c9f865022a1823d81…
https://git.kernel.org/stable/c/b13a3dbfa196af68e…
https://git.kernel.org/stable/c/895123c309a34d2cf…
https://git.kernel.org/stable/c/4ae1e46d8a290319f…
https://git.kernel.org/stable/c/00312419f08639646…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 5434ae74629af58ad0fc27143a9ea435f7734410 , < 01324c0328181b94cf390bda22ff91c75126ea57 (git) Affected: 5434ae74629af58ad0fc27143a9ea435f7734410 , < 2e9a95d60f1df7b57618fd5ef057aef331575bd2 (git) Affected: 5434ae74629af58ad0fc27143a9ea435f7734410 , < c9f865022a1823d814032a09906e91e4701a35fc (git) Affected: 5434ae74629af58ad0fc27143a9ea435f7734410 , < b13a3dbfa196af68eae2031f209743735ad416bf (git) Affected: 5434ae74629af58ad0fc27143a9ea435f7734410 , < 895123c309a34d2cfccf7812b41e17261a3a6f37 (git) Affected: 5434ae74629af58ad0fc27143a9ea435f7734410 , < 4ae1e46d8a290319f33f71a2710a1382ba5431e8 (git) Affected: 5434ae74629af58ad0fc27143a9ea435f7734410 , < 00312419f0863964625d6dcda8183f96849412c6 (git)
Linux	Linux	Affected: 4.20 Unaffected: 0 , < 4.20 (semver) Unaffected: 5.10.248 , ≤ 5.10.* (semver) Unaffected: 5.15.198 , ≤ 5.15.* (semver) Unaffected: 6.1.160 , ≤ 6.1.* (semver) Unaffected: 6.6.120 , ≤ 6.6.* (semver) Unaffected: 6.12.64 , ≤ 6.12.* (semver) Unaffected: 6.18.4 , ≤ 6.18.* (semver) Unaffected: 6.19 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-71078",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:05:39.588741Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-362",
                "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T18:15:11.106Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/powerpc/include/asm/book3s/64/mmu-hash.h",
            "arch/powerpc/kernel/process.c",
            "arch/powerpc/mm/book3s64/internal.h",
            "arch/powerpc/mm/book3s64/mmu_context.c",
            "arch/powerpc/mm/book3s64/slb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "01324c0328181b94cf390bda22ff91c75126ea57",
              "status": "affected",
              "version": "5434ae74629af58ad0fc27143a9ea435f7734410",
              "versionType": "git"
            },
            {
              "lessThan": "2e9a95d60f1df7b57618fd5ef057aef331575bd2",
              "status": "affected",
              "version": "5434ae74629af58ad0fc27143a9ea435f7734410",
              "versionType": "git"
            },
            {
              "lessThan": "c9f865022a1823d814032a09906e91e4701a35fc",
              "status": "affected",
              "version": "5434ae74629af58ad0fc27143a9ea435f7734410",
              "versionType": "git"
            },
            {
              "lessThan": "b13a3dbfa196af68eae2031f209743735ad416bf",
              "status": "affected",
              "version": "5434ae74629af58ad0fc27143a9ea435f7734410",
              "versionType": "git"
            },
            {
              "lessThan": "895123c309a34d2cfccf7812b41e17261a3a6f37",
              "status": "affected",
              "version": "5434ae74629af58ad0fc27143a9ea435f7734410",
              "versionType": "git"
            },
            {
              "lessThan": "4ae1e46d8a290319f33f71a2710a1382ba5431e8",
              "status": "affected",
              "version": "5434ae74629af58ad0fc27143a9ea435f7734410",
              "versionType": "git"
            },
            {
              "lessThan": "00312419f0863964625d6dcda8183f96849412c6",
              "status": "affected",
              "version": "5434ae74629af58ad0fc27143a9ea435f7734410",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/powerpc/include/asm/book3s/64/mmu-hash.h",
            "arch/powerpc/kernel/process.c",
            "arch/powerpc/mm/book3s64/internal.h",
            "arch/powerpc/mm/book3s64/mmu_context.c",
            "arch/powerpc/mm/book3s64/slb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "lessThan": "4.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.248",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.198",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.64",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.248",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.198",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.160",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.120",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.64",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.4",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/64s/slb: Fix SLB multihit issue during SLB preload\n\nOn systems using the hash MMU, there is a software SLB preload cache that\nmirrors the entries loaded into the hardware SLB buffer. This preload\ncache is subject to periodic eviction \u2014 typically after every 256 context\nswitches \u2014 to remove old entry.\n\nTo optimize performance, the kernel skips switch_mmu_context() in\nswitch_mm_irqs_off() when the prev and next mm_struct are the same.\nHowever, on hash MMU systems, this can lead to inconsistencies between\nthe hardware SLB and the software preload cache.\n\nIf an SLB entry for a process is evicted from the software cache on one\nCPU, and the same process later runs on another CPU without executing\nswitch_mmu_context(), the hardware SLB may retain stale entries. If the\nkernel then attempts to reload that entry, it can trigger an SLB\nmulti-hit error.\n\nThe following timeline shows how stale SLB entries are created and can\ncause a multi-hit error when a process moves between CPUs without a\nMMU context switch.\n\nCPU 0                                   CPU 1\n-----                                    -----\nProcess P\nexec                                    swapper/1\n load_elf_binary\n  begin_new_exc\n    activate_mm\n     switch_mm_irqs_off\n      switch_mmu_context\n       switch_slb\n       /*\n        * This invalidates all\n        * the entries in the HW\n        * and setup the new HW\n        * SLB entries as per the\n        * preload cache.\n        */\ncontext_switch\nsched_migrate_task migrates process P to cpu-1\n\nProcess swapper/0                       context switch (to process P)\n(uses mm_struct of Process P)           switch_mm_irqs_off()\n                                         switch_slb\n                                           load_slb++\n                                            /*\n                                            * load_slb becomes 0 here\n                                            * and we evict an entry from\n                                            * the preload cache with\n                                            * preload_age(). We still\n                                            * keep HW SLB and preload\n                                            * cache in sync, that is\n                                            * because all HW SLB entries\n                                            * anyways gets evicted in\n                                            * switch_slb during SLBIA.\n                                            * We then only add those\n                                            * entries back in HW SLB,\n                                            * which are currently\n                                            * present in preload_cache\n                                            * (after eviction).\n                                            */\n                                        load_elf_binary continues...\n                                         setup_new_exec()\n                                          slb_setup_new_exec()\n\n                                        sched_switch event\n                                        sched_migrate_task migrates\n                                        process P to cpu-0\n\ncontext_switch from swapper/0 to Process P\n switch_mm_irqs_off()\n  /*\n   * Since both prev and next mm struct are same we don\u0027t call\n   * switch_mmu_context(). This will cause the HW SLB and SW preload\n   * cache to go out of sync in preload_new_slb_context. Because there\n   * was an SLB entry which was evicted from both HW and preload cache\n   * on cpu-1. Now later in preload_new_slb_context(), when we will try\n   * to add the same preload entry again, we will add this to the SW\n   * preload cache and then will add it to the HW SLB. Since on cpu-0\n   * this entry was never invalidated, hence adding this entry to the HW\n   * SLB will cause a SLB multi-hit error.\n   */\nload_elf_binary cont\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - An attacker reaches the vulnerable SLB preload path through local execve() execution and induced scheduler migrations; it is not directly reachable through network traffic.\nAC:L - The attacker can repeatedly execute processes, induce context switches, and control migrations using same-owner CPU-affinity operations until the 8-bit load_slb counter wraps, without depending on victim-controlled state.\nPR:L - Ordinary unprivileged users may execute binaries and modify the affinity of their own processes; no capability, namespace privilege, or administrative access is required.\nUI:N - Exploitation is performed entirely through attacker-controlled processes and scheduling activity without requiring another user to take an action.\nS:U - The vulnerable process and affected kernel or partition remain within the same host security authority; this is not inherently a guest-to-host or other cross-scope escape.\nC:H - SLB corruption affects hardware address translation, and Power hardware can combine the VSIDs of multiple matching entries before raising the machine check. In the highest defensible case, an unintended translation can expose arbitrary mapped memory.\nI:H - The same unintended hardware translation can redirect stores and corrupt arbitrary memory or control data, potentially enabling privilege escalation or code execution.\nA:H - An SLB multihit generates a synchronous machine-check exception and warning; unsuccessful recovery, panic-on-warning configurations, or repeated triggering can crash the kernel or terminate the partition."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:11:54.417Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/01324c0328181b94cf390bda22ff91c75126ea57"
        },
        {
          "url": "https://git.kernel.org/stable/c/2e9a95d60f1df7b57618fd5ef057aef331575bd2"
        },
        {
          "url": "https://git.kernel.org/stable/c/c9f865022a1823d814032a09906e91e4701a35fc"
        },
        {
          "url": "https://git.kernel.org/stable/c/b13a3dbfa196af68eae2031f209743735ad416bf"
        },
        {
          "url": "https://git.kernel.org/stable/c/895123c309a34d2cfccf7812b41e17261a3a6f37"
        },
        {
          "url": "https://git.kernel.org/stable/c/4ae1e46d8a290319f33f71a2710a1382ba5431e8"
        },
        {
          "url": "https://git.kernel.org/stable/c/00312419f0863964625d6dcda8183f96849412c6"
        }
      ],
      "title": "powerpc/64s/slb: Fix SLB multihit issue during SLB preload",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-71078",
    "datePublished": "2026-01-13T15:34:43.437Z",
    "dateReserved": "2026-01-13T15:30:19.648Z",
    "dateUpdated": "2026-10-19T18:15:11.106Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted