cbcvebase.
CVE-2025-71078
published 2026-01-13

CVE-2025-71078: In the Linux kernel, the following vulnerability has been resolved: powerpc/64s/slb: Fix SLB multihit issue during SLB preload On systems using the hash MMU…

PriorityP338high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.12%
2.2th percentile
In the Linux kernel, the following vulnerability has been resolved: powerpc/64s/slb: Fix SLB multihit issue during SLB preload On systems using the hash MMU, there is a software SLB preload cache that mirrors the entries loaded into the hardware SLB buffer. This preload cache is subject to periodic eviction — typically after every 256 context switches — to remove old entry. To optimize performance, the kernel skips switch_mmu_context() in switch_mm_irqs_off() when the prev and next mm_struct are the same. However, on hash MMU systems, this can lead to inconsistencies between the hardware SLB and the software preload cache. If an SLB entry for a process is evicted from the software cache on one CPU, and the same process later runs on another CPU without executing switch_mmu_context(), the hardware SLB may retain stale entries. If the kernel then attempts to reload that entry, it can trigger an SLB multi-hit error. The following timeline shows how stale SLB entries are created and can cause a multi-hit error when a process moves between CPUs without a MMU context switch. CPU 0 CPU 1 ----- ----- Process P exec swapper/1 load_elf_binary begin_new_exc activate_mm switch_mm_irqs_off switch_mmu_context switch_slb /* * This invalidates all * the entries in the HW * and setup the new HW * SLB entries as per the * preload cache. */ context_switch sched_migrate_task migrates process P to cpu-1 Process swapper/0 context switch (to process P) (uses mm_struct of Process P) switch_mm_irqs_off() switch_slb load_slb++ /* * load_slb becomes 0 here * and we evict an entry from * the preload cache with * preload_age(). We still * keep HW SLB and preload * cache in sync, that is * because all HW SLB entries * anyways gets evicted in * switch_slb during SLBIA. * We then only add those * entries back in HW SLB, * which are currently * present in preload_cache * (after eviction). */ load_elf_binary continues... setup_new_exec() slb_setup_new_exec() sched_switch event sched_migrate_

Affected

65 ranges· showing 25
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.162-1 (bookworm)linux 6.1.162-1 (bookworm)
debianlinux-6.1< linux 6.1.162-1 (bookworm)linux 6.1.162-1 (bookworm)
linuxlinux
linuxlinux>= 5434ae74629af58ad0fc27143a9ea435f7734410 < 01324c0328181b94cf390bda22ff91c75126ea5701324c0328181b94cf390bda22ff91c75126ea57
linuxlinux>= 5434ae74629af58ad0fc27143a9ea435f7734410 < 2e9a95d60f1df7b57618fd5ef057aef331575bd22e9a95d60f1df7b57618fd5ef057aef331575bd2
linuxlinux>= 5434ae74629af58ad0fc27143a9ea435f7734410 < c9f865022a1823d814032a09906e91e4701a35fcc9f865022a1823d814032a09906e91e4701a35fc
linuxlinux>= 5434ae74629af58ad0fc27143a9ea435f7734410 < b13a3dbfa196af68eae2031f209743735ad416bfb13a3dbfa196af68eae2031f209743735ad416bf
linuxlinux>= 5434ae74629af58ad0fc27143a9ea435f7734410 < 895123c309a34d2cfccf7812b41e17261a3a6f37895123c309a34d2cfccf7812b41e17261a3a6f37
linuxlinux>= 5434ae74629af58ad0fc27143a9ea435f7734410 < 4ae1e46d8a290319f33f71a2710a1382ba5431e84ae1e46d8a290319f33f71a2710a1382ba5431e8
linuxlinux>= 5434ae74629af58ad0fc27143a9ea435f7734410 < 00312419f0863964625d6dcda8183f96849412c600312419f0863964625d6dcda8183f96849412c6
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel>= 0 < 6.1.162-16.1.162-1
linuxlinux_kernel>= 0 < 6.12.69-16.12.69-1
linuxlinux_kernel>= 0 < 6.18.5-16.18.5-1
linuxlinux_kernel>= 0 < 5.15.0-173.1835.15.0-173.183
linuxlinux_kernel>= 4.20.0 < 5.10.2485.10.248
linuxlinux_kernel>= 4.20.1 < 5.10.2485.10.248

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
vendor_ubuntu7.8HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.