CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

x86/apic: Disable x2apic on resume if the kernel expects so

When resuming from s2ram, firmware may re-enable x2apic mode, which may have
been disabled by the kernel during boot either because it doesn't support IRQ
remapping or for other reasons. This causes the kernel to continue using the
xapic interface, while the hardware is in x2apic mode, which causes hangs.
This happens on defconfig + bare metal + s2ram.

Fix this in lapic_resume() by disabling x2apic if the kernel expects it to be
disabled, i.e. when x2apic_mode = 0.

The ACPI v6.6 spec, Section 16.3 [1] says firmware restores either the
pre-sleep configuration or initial boot configuration for each CPU, including
MSR state:

  When executing from the power-on reset vector as a result of waking from an
  S2 or S3 sleep state, the platform firmware performs only the hardware
  initialization required to restore the system to either the state the
  platform was in prior to the initial operating system boot, or to the
  pre-sleep configuration state. In multiprocessor systems, non-boot
  processors should be placed in the same state as prior to the initial
  operating system boot.

  (further ahead)

  If this is an S2 or S3 wake, then the platform runtime firmware restores
  minimum context of the system before jumping to the waking vector. This
  includes:

	CPU configuration. Platform runtime firmware restores the pre-sleep
	configuration or initial boot configuration of each CPU (MSR, MTRR,
	firmware update, SMBase, and so on). Interrupts must be disabled (for
	IA-32 processors, disabled by CLI instruction).

	(and other things)

So at least as per the spec, re-enablement of x2apic by the firmware is
allowed if "x2apic on" is a part of the initial boot configuration.

  [1] https://uefi.org/specs/ACPI/6.6/16_Waking_and_Sleeping.html#initialization

  [ bp: Massage. ]

The Linux kernel CVE team has assigned CVE-2026-43363 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 2.6.28 with commit 6e1cb38a2aef7680975e71f23de187859ee8b158 and fixed in 5.10.253 with commit a6ad6f2e31b524cbb66b2f370bad0cf17d327e6c
	Issue introduced in 2.6.28 with commit 6e1cb38a2aef7680975e71f23de187859ee8b158 and fixed in 5.15.203 with commit 3dd0812a7c764cd8f3b0182441ac22da0a7f3b09
	Issue introduced in 2.6.28 with commit 6e1cb38a2aef7680975e71f23de187859ee8b158 and fixed in 6.1.167 with commit 965289b120cc68cca886c75219c68b8c15751d73
	Issue introduced in 2.6.28 with commit 6e1cb38a2aef7680975e71f23de187859ee8b158 and fixed in 6.6.130 with commit f591938072115bf08730b8530c67fab189cc6308
	Issue introduced in 2.6.28 with commit 6e1cb38a2aef7680975e71f23de187859ee8b158 and fixed in 6.12.78 with commit 1a85f84214f9d790216547ac6086bf8033cd9e5a
	Issue introduced in 2.6.28 with commit 6e1cb38a2aef7680975e71f23de187859ee8b158 and fixed in 6.18.19 with commit 11712c4eb384098db4cb08792e223c818b908c1a
	Issue introduced in 2.6.28 with commit 6e1cb38a2aef7680975e71f23de187859ee8b158 and fixed in 6.19.9 with commit 1d8440c1e7c49715f937416ac90cf260f1f1712c
	Issue introduced in 2.6.28 with commit 6e1cb38a2aef7680975e71f23de187859ee8b158 and fixed in 7.0 with commit 8cc7dd77a1466f0ec58c03478b2e735a5b289b96

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-43363
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	arch/x86/kernel/apic/apic.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/a6ad6f2e31b524cbb66b2f370bad0cf17d327e6c
	https://git.kernel.org/stable/c/3dd0812a7c764cd8f3b0182441ac22da0a7f3b09
	https://git.kernel.org/stable/c/965289b120cc68cca886c75219c68b8c15751d73
	https://git.kernel.org/stable/c/f591938072115bf08730b8530c67fab189cc6308
	https://git.kernel.org/stable/c/1a85f84214f9d790216547ac6086bf8033cd9e5a
	https://git.kernel.org/stable/c/11712c4eb384098db4cb08792e223c818b908c1a
	https://git.kernel.org/stable/c/1d8440c1e7c49715f937416ac90cf260f1f1712c
	https://git.kernel.org/stable/c/8cc7dd77a1466f0ec58c03478b2e735a5b289b96