{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-98228","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-09-25T10:25:14.328Z","datePublished":"2026-10-06T08:45:03.154Z","dateUpdated":"2026-10-07T06:49:31.714Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-10-07T06:49:31.714Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nmips: select CONFIG_WEAK_REORDERING_BEYOND_LLSC from CONFIG_EYEQ\n\nOn I6500 CPU cores, lld and scd give no ordering guarantees (same as all\nother instructions). To respect the assumption that arch_cmpxchg() is\nfully ordered, we must inject sync instructions above and below our\nlld/scd loops using the already in place WEAK_REORDERING_BEYOND_LLSC\ninfrastructure.\n\nOtherwise, bad things can happen:\n\n[   34.054496] CPU 3 Unable to handle kernel paging request at virtual address 0000000000000000, epc == a80000080838e01c, ra == a80000080838dfc4\n[   34.054559] Oops[#1]:\n[   34.069561] CPU: 3 UID: 0 PID: 170 Comm: pipe_race Not tainted 7.2.0-rc6-01553-gb73c35220968-dirty #103 VOLUNTARY\n[   34.079932] Hardware name: Mobile EyeQ5 MP5 Evaluation board\n[   34.085592] $ 0   : 0000000000000000 0000000000000001 0000000000000000 0000000000000000\n[   34.093616] $ 4   : a800000808ee2618 000000000b7a879d 0000000000001000 0000000000000000\n[   34.101638] $ 8   : 0000000000e3f2c9 0000000000000000 a800000808a2a9f8 0000000000000000\n[   34.109660] $12   : a8000008139ffcd8 ffffffff84080018 a80000080837fae0 7878787878787878\n[   34.117682] $16   : a800000807e82940 0000000000001000 0000000000000000 0000000000000000\n[   34.125704] $20   : a800000802920e00 a8000008139ffdf8 a800000802649400 0000000000e3f2c9\n[   34.133726] $24   : 0000000000000006 00000001200406e0\n[   34.141783] $28   : a8000008139fc000 a8000008139ffd10 0000000000e3f2c8 a80000080838dfc4\n[   34.149837] epc   : a80000080838e01c anon_pipe_read+0xd4/0x428\n[   34.155697] ra    : a80000080838dfc4 anon_pipe_read+0x7c/0x428\n[   34.161549] Status: 140000e3  KX SX UX KERNEL EXL IE\n[   34.166551] Cause : 40800408 (ExcCode 02)\n[   34.170574] BadVA : 0000000000000000\n[   34.174161] PrId  : 0001b028 (MIPS I6500)\n[   34.178183] Process pipe_race (pid: 170, threadinfo=000000005ca35720, task=00000000e1013890, tls=000000014ebbb780)\n[   34.188568] Stack : a800000802649400 0000000000000000 0000000000000000 a8000008139ffdd0\n[   34.196623]\t 0000000000000fba a800000808ee0000 0000000000000001 a8000008130c3e80\n[   34.204676]\t a8000008080d1280 a8000008139ffd58 a8000008139ffd58 1dbd2b22ea1dd500\n[   34.212729]\t a800000802649400 a800000808ee0000 ffffffffffffffea 0000000000000001\n[   34.220783]\t 0000000000001000 0000000000000000 00000001200ae518 ffffffffffffffff\n[   34.228836]\t 000000fffbe0e530 a80000080837edf4 000000fffbe0e530 0000000000000000\n[   34.236890]\t 0000000000000000 0000000000000000 000000014ebb55a0 0000000000001000\n[   34.244943]\t 0000000000000001 a800000802649400 0000000000000000 0000000000000000\n[   34.252996]\t 0000000000000000 0000400400000000 0000000000000000 1dbd2b22ea1dd500\n[   34.261049]\t 00000000140000e3 a800000802649400 a800000802649400 a800000808ee0000\n[   34.269103]\t ...\n[   34.271568] Call Trace:\n[   34.274026] [<a80000080838e01c>] anon_pipe_read+0xd4/0x428\n[   34.279533] [<a80000080837edf4>] vfs_read+0x25c/0x318\n[   34.284607] [<a80000080837faac>] ksys_read+0x104/0x138\n[   34.289763] [<a80000080802b9cc>] syscall_common+0x44/0x68\n[   34.295187]\n[   34.296689] Code: f84000cf  02209825  de020010 <dc420000> d8400004  02002825  0040f809  02802025  f84000c3\n[   34.306504]\n[   34.308099] ---[ end trace 0000000000000000 ]---\n\nMy initial reproducer was the xdp-tools test suite. A standalone\nreproducer would be an lld/scd loop that, when the read is reordered by\nthe CPU, triggers a fault. We can achieve this from userspace by\nstressing an anonymous pipe, which uses a mutex. Program used:\n\n\t// SPDX-License-Identifier: GPL-2.0\n\t// pipe_race.c - reproducer for MIPS LL/SC reordering vs fs/pipe.c\n\t//\n\t// Two userspace processes on an anonymous pipe:\n\t//   parent  = writer: tight write() loop\n\t//   child   = reader: tight read() loop\n\n\t#define _GNU_SOURCE\n\t#include <assert.h>\n\t#include <errno.h>\n\t#include <sched.h>\n\t#include <signal.h>\n\t#include <stdio.h>\n\t#include <stdlib.h>\n\t#include <string.h>\n\t#include <sys/types.h>\n\t#include\n---truncated---"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The bug is a missing sync around lld/scd in arch_cmpxchg/xchg and the atomics on EyeQ (I6500) kernels. A local process reaches it through ordinary syscalls that take kernel locks, such as pipe write()/read() into anon_pipe_read() under pipe->mutex. No remote peer supplies data that causes the misordering.\nAC:L - The attacker controls both sides of the race: a writer process and a reader process looping on one anonymous pipe. The commit's trivial reproducer oopses within seconds. The SMP setup it needs (MIPS_CPS, NR_CPUS=16) is the shipped EyeQ default, not a rare configuration.\nPR:L - The only requirement is an ordinary unprivileged local account that can call pipe(), fork(), read() and write(). No capability or namespace is needed on the path to the mutex and cmpxchg operations that lack barriers.\nUI:N - The attacker's own processes cause the reordering. No other user needs to do anything.\nS:U - The corruption stays inside the kernel's own data structures, and the result is ordinary kernel compromise or a crash. No VM, IOMMU or other boundary is crossed.\nC:H - With no LL/SC ordering, mutex, qspinlock and cmpxchg acquire semantics fail, so loads protected by a lock can see stale state, e.g. pipe_buffer page pointers in anon_pipe_read(). That can lead to reads of freed or reused kernel memory being copied to userspace.\nI:H - Losing lock ordering across the kernel lets critical sections overlap. Refcounts, list links and buffer pointers can be corrupted, which gives use-after-free style write primitives, not just a crash.\nA:H - The commit shows an unprivileged pipe stress loop causing a kernel oops (NULL dereference in anon_pipe_read). It can be repeated at will to crash EyeQ systems."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/mips/Kconfig"],"versions":[{"version":"fbe0fae601b780622fcb7034a479fa161645b9f4","lessThan":"3f017c2ca8c31a1e135dd87be647096866d6b196","status":"affected","versionType":"git"},{"version":"fbe0fae601b780622fcb7034a479fa161645b9f4","lessThan":"bbc448c541ed90d52f9ec22f17394304e3bf170e","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/mips/Kconfig"],"versions":[{"version":"6.11","status":"affected"},{"version":"0","lessThan":"6.11","status":"unaffected","versionType":"semver"},{"version":"7.2.8","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3-rc4","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"7.2.8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"7.3-rc4"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/3f017c2ca8c31a1e135dd87be647096866d6b196"},{"url":"https://git.kernel.org/stable/c/bbc448c541ed90d52f9ec22f17394304e3bf170e"}],"title":"mips: select CONFIG_WEAK_REORDERING_BEYOND_LLSC from CONFIG_EYEQ","x_generator":{"engine":"bippy-1.2.0"}}}}