{"id":"CVE-2026-98888","kind":"vulnerability","aliases":["CVE-2026-98888"],"related":[],"title":"Linux kernel arm64: nested kprobe hits can leave interrupts disabled","description":"In the Linux kernel, the following vulnerability has been resolved:\n\narm64: kprobes: Allow reentering kprobes while single-stepping\n\nA kprobe can be hit while another kprobe is in KPROBE_HIT_SS state. This\ncan happen when tracing or perf code runs from the debug exception path\nwhile the first kprobe is preparing or executing its out-of-line\nsingle-step instruction.\n\nCurrently arm64 treats a kprobe hit in KPROBE_HIT_SS as unrecoverable,\nthe same as a hit in KPROBE_REENTER. This is too strict. A hit in\nKPROBE_HIT_SS is still a one-level reentry and can be handled by saving\nthe current kprobe state and setting up single-step for the new probe,\njust like reentry from KPROBE_HIT_ACTIVE or KPROBE_HIT_SSDONE.\n\nThe truly unrecoverable case is hitting another kprobe while already in\nKPROBE_REENTER, because the reentry save area has already been consumed.\n\nMove KPROBE_HIT_SS to the recoverable reentry cases and leave\nKPROBE_REENTER as the unrecoverable nested reentry case.\n\nThis change also requires saving saved_irqflag in struct prev_kprobe.\nWhen a nested kprobe calls kprobes_save_local_irqflag(), it overwrites\nkcb->saved_irqflag with the currently masked DAIF value, losing the\nouter kprobe's original DAIF state. Without this fix, when the outer\nkprobe's single-step finishes, kprobes_restore_local_irqflag() applies\nthe wrong DAIF mask and leaves interrupts permanently disabled.\n\nExtend struct prev_kprobe with a saved_irqflag field and save/restore it\nalongside kp and status. This ensures the outer kprobe's original\ninterrupt state is preserved across reentry.\n\nThis mirrors the x86 fix in commit 6a5022a56ac3\n(\"kprobes/x86: Allow to handle reentered kprobe on single-stepping\").","summary":"On arm64, a kprobe hit while another kprobe is single-stepping was treated as unrecoverable, and a nested hit could overwrite the saved interrupt state. The fix allows one level of reentry and preserves the outer interrupt flags, so a nested probe no longer leaves interrupts permanently masked.","severity":"unknown","cvss":null,"epss":0.00215,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["arm64","kernel","linux","runtime"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-23T12:18:22+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T05:00:03+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T05:00:03Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel arm64: nested kprobe hits can leave interrupts disabled","impact":"low","summary":"On arm64, a kprobe hit while another kprobe is single-stepping was treated as unrecoverable, and a nested hit could overwrite the saved interrupt state. The fix allows one level of reentry and preserves the outer interrupt flags, so a nested probe no longer leaves interrupts permanently masked.","category":"runtime","nicknames":[],"who_cares":["linux","arm64","kernel"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown","analyst_note":"Sources give only the NVD record and kernel commit text; check the linked kernel stable commits for affected and fixed kernel versions.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000567,"input_tokens":3894,"output_tokens":356,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98888':13A,16A '6a5022a56ac3':344C 'across':335C 'activ':197C 'allow':49B,82C,346C 'alongsid':320C 'alreadi':211C,221C 'also':245C 'anoth':27B,95C,208C 'appli':298C 'area':219C 'arm64':3A,17B,22B,80C,135C 'call':258C 'case':205C,232C,242C 'chang':244C 'code':110C 'commit':343C 'consum':223C 'could':41B 'current':134C,178C,270C 'cve':11A,14A 'daif':272C,280C,301C 'debug':114C 'disabl':10A,307C 'ensur':325C 'except':115C 'execut':124C 'extend':308C 'field':316C 'finish':293C 'first':119C 'fix':48B,284C,341C 'flag':59B 'follow':75C 'handl':174C,348C 'happen':105C 'hit':6A,25B,40B,93C,100C,139C,142C,150C,159C,162C,196C,200C,207C,226C 'instruct':133C 'interrupt':9A,45B,58B,67B,305C,331C 'irqflag':249C,262C,267C,297C,315C 'kcb':265C 'kernel':2A,18B,73C 'kp':321C 'kprobe':5A,24B,28B,81C,84C,90C,96C,99C,120C,138C,141C,152C,161C,179C,195C,199C,209C,213C,225C,235C,253C,257C,259C,277C,288C,294C,311C,328C,350C 'kprobes/x86':345C 'leav':8A,66B,234C,304C 'level':51B,169C 'like':192C 'line':129C 'linux':1A,19B,72C 'local':261C,296C 'longer':65B 'lose':274C 'mask':69B,271C,302C 'mirror':338C 'move':224C 'nest':4A,39B,62B,240C,256C 'new':189C 'one':50B,168C 'one-level':167C 'origin':279C,330C 'out-of-lin':126C 'outer':57B,276C,287C,327C 'overwrit':42B,264C 'path':116C 'perf':109C 'perman':68B,306C 'prepar':122C 'preserv':55B,334C 'prev':252C,310C 'probe':63B,190C 'recover':230C 'reenter':83C,153C,214C,236C,349C 'reentri':53B,170C,193C,217C,231C,241C,336C 'requir':246C 'resolv':79C 'restor':295C 'run':111C 'runtim':20B 'save':44B,176C,218C,247C,248C,260C,266C,314C 'save/restore':318C 'set':182C 'singl':31B,87C,131C,185C,291C,353C 'single-step':30B,86C,130C,184C,290C,352C 'ss':101C,143C,163C,227C 'ssdone':201C 'state':46B,102C,180C,281C,332C 'status':323C 'step':32B,88C,132C,186C,292C,354C 'still':165C 'strict':157C 'struct':251C,309C 'trace':107C 'treat':34B,136C 'truli':203C 'unrecover':36B,145C,204C,239C 'valu':273C 'vulner':76C 'without':282C 'wrong':300C 'x86':340C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T12:18:22+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98888","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98888","severity":null,"published_at":"2026-10-23T12:18:22+00:00","modified_at":"2026-10-23T12:18:22+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-98888","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98888","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}