{"metadata": {"vulnerability": "CVE-2026-98395", "count": 15, "kinds": {"milestone": 6, "sighting": 1, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-09-25T10:25:14.346Z", "date_only": false, "value": "2026-09-25T10:25:14.346Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-98395", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-98395", "record": "UBUNTU-CVE-2026-98395", "field": "published"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-98395", "record": "UBUNTU-CVE-2026-98395", "field": "modified"}, {"timestamp": "2026-10-14T13:25:57.887Z", "date_only": false, "value": "2026-10-14T13:25:57.887Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-98395", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-14T14:17:50Z", "date_only": false, "value": "2026-10-14T14:17:50Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-C6R3-334M-J754", "record": "GHSA-C6R3-334M-J754", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-14T14:17:50.407Z", "date_only": false, "value": "2026-10-14T14:17:50.407", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-98395", "record": "FKIE_CVE-2026-98395", "field": "published"}, {"timestamp": "2026-10-14T15:32:19Z", "date_only": false, "value": "2026-10-14T15:32:19Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-C6R3-334M-J754", "record": "GHSA-C6R3-334M-J754", "field": "published"}, {"timestamp": "2026-10-14T15:32:19Z", "date_only": false, "value": "2026-10-14T15:32:19Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-C6R3-334M-J754", "record": "GHSA-C6R3-334M-J754", "field": "modified"}, {"timestamp": "2026-10-14T18:28:46.877Z", "date_only": false, "value": "2026-10-14T18:28:46.877221Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117440677560723706", "record": "CVE-2026-98395", "field": "creation_timestamp", "uuid": "d0540ed8-b151-4836-b453-5691551e8183", "content": "CVE-2026-98395 powerpc/entry: Fix irq_soft_mask corruption on replayed interrupt exit In the Linux kernel, the following vulnerability has been resolved:\npowerpc/entry: Fix irq_soft_mask corruption on replayed interrupt exit\nWhen __replay_soft_interrupts() replays a pending interrupt (e.g.PACA_IRQ_DEC -> timer_interrupt), it calls the handler directly with asynthetic pt_regs. The DEFINE_INTERRUPT_HANDLER_ASYNC wrapper aroundeach handler calls arch_interrupt_async_exit_prepare() on the way out,which calls arch_interrupt_exit_prepare() -> local_irq_disable() ->arch_local_irq_disable(), which does:\n    irq_soft_mask_set(IRQS_DISABLED)   /* 0x1 */\nThis unconditionally overwrites irq_soft_mask with IRQS_DISABLED (0x1),stripping the IRQS_PMI_DISABLED (0x2) bit. The result is thatirq_soft_mask is 0x1 instead of IRQS_ALL_DISABLED (0x3) when thehandler returns to __replay_soft_interrupts().\nFor a normally-taken interrupt this is harmless: the next interruptalways enters through arch_interrupt_enter_prepare() whichunconditionally sets irq_soft_mask to IRQS_ALL_DISABLED. But duringreplay, next_interrupt() is called directly between replayed handlerswithout going back through arch_interrupt_enter_prepare(), so thestripped bit is never restored. next_interrupt() then fires a WARNING:\n    WARNING: arch/powerpc/kernel/irq_64.c:75    WARN_ON(irq_soft_mask_return() != IRQS_ALL_DISABLED)\nThe warning was observed early in boot on a POWER10 pseries guestduring kmem_cache_init_late(), where a spinlock release triggersinterrupt replay that processes a pending timer interrupt.\nDebugger state confirming the bug:  Before timer_interrupt(&regs):    irq_soft_mask = 0x3 (IRQS_ALL_DISABLED)   correct    irq_happened  = 0x41 (HARD_DIS|REPLAYING)  correct  After timer_interrupt(&regs) returns:    irq_soft_mask = 0x1 (IRQS_DISABLED)        WRONG - PMI bit stripped    irq_happened  = 0x41                        unchanged\nThe fix is to replace local_irq_disable() with hard_irq_disable().\nhard_irq_disable() is the right primitive here for two reasons:\n1. On PPC64 (hw_irq.h:301) it calls irq_soft_mask_set_return(IRQS_ALL_DISABLED),   setting the soft mask to 0x3 (both IRQS_DISABLED and IRQS_PMI_DISABLED),   which preserves the PMI bit and fixes the WARNING. The additional   work it does (__hard_irq_disable(), PACA_IRQ_HARD_DIS |=) is   redundant but safe since both are already set at this point in the   exit path; the trace_hardirqs_off() inside is guarded by   if (!arch_irqs_disabled_flags(flags)) so it will not double-fire.\n2. On PPC32 (hw_irq.h:467) hard_irq_disable() maps to   arch_local_irq_disable() -> __hard_irq_disable(), which clears   MSR[EE] in hardware. This is exactly correct: PPC32 has no soft-mask   PACA mechanism, so the hardware disable is the right way to satisfy   irqentry_exit()'s requirement. This also fixes a build error on PPC32   where irq_soft_mask_set() is only defined under CONFIG_PPC64:\n       arch/powerpc/include/asm/entry-common.h:273: error: implicit       declaration of function 'irq_soft_mask_set'\n   Using hard_irq_disable() requires no #ifdef and is consistent with   how the rest of the entry code (e.g. entry-common.h:463) handles the   same PPC32/PPC64 split.\nhttps://www.cve.org/CVERecord?id=CVE-2026-98395https://git.kernel.org/stable/c/95cd316a896f1c1aa4ee4a817ba3d4691103c81bhttps://git.kernel.org/stable/c/63a7531ca31f9f097d9cc1cc3fe86ae683cdabdd#kernel #Linux#CVE_2026_98395#bot", "url": "https://infosec.exchange/users/cve/statuses/117440677560723706"}, {"timestamp": "2026-10-16T06:05:37.830Z", "date_only": false, "value": "2026-10-16T06:05:37.830105Z", "kind": "milestone", "label": "Published", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-98395", "record": "BELL-CVE-2026-98395", "field": "published"}, {"timestamp": "2026-10-16T06:42:47.853Z", "date_only": false, "value": "2026-10-16T06:42:47.85362Z", "kind": "other", "label": "Updated", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-98395", "record": "BELL-CVE-2026-98395", "field": "modified"}, {"timestamp": "2026-10-16T06:42:47.853Z", "date_only": false, "value": "2026-10-16T06:42:47.85362Z", "kind": "other", "label": "Withdrawn", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-98395", "record": "BELL-CVE-2026-98395", "field": "withdrawn"}, {"timestamp": "2026-10-19T09:18:48.849Z", "date_only": false, "value": "2026-10-19T09:18:48.849Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-98395", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-19T09:18:48.849Z", "date_only": false, "value": "2026-10-19T09:18:48.849Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Linux", "record": "CVE-2026-98395", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-19T10:18:42.880Z", "date_only": false, "value": "2026-10-19T10:18:42.880", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-98395", "record": "FKIE_CVE-2026-98395", "field": "lastModified"}]}