SB20260816368 - Improper locking in Linux kernel openrisc kernel

Description

This security bulletin contains information about 1 vulnerability.

1) Improper locking (CVE-ID: CVE-2026-72154)

CWE-ID: CWE-667 - Improper Locking

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper cache synchronization in jump label handling in arch/openrisc/kernel/jump_label.c and arch/openrisc/kernel/patching.c when updating static keys on SMP systems. A local user can trigger static key updates to cause a denial of service.

The issue affects OpenRISC SMP systems, and stale instruction cache lines may persist on remote cores after code patching.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/3fac46068fe4cea22ed373432b9173a915e8e60d
• https://git.kernel.org/stable/c/57740658042daf591c57d6e700d9a304d5972552
• https://git.kernel.org/stable/c/aca063c9024522e4e5b9a9d1927433f6a01785a3