From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3CCDA3ED5D0 for ; Fri, 8 May 2026 14:22:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778250149; cv=none; b=jeevfq7IlwheJoijTS+Ty0T94/EWgx36u4E1QDe2N30c+6zDxn9xRkCywzQWBsdy6JJ+DA98QT6gr4TBUR2WUhmWIMwB4zCU9NYIEyIVXHGaqPpKxP+KK8MyvyDv3LxbtTatPQnBNoEMCJau1UkonR3J2ejU9fn7tN3Xh4FM/Q4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778250149; c=relaxed/simple; bh=a5bD/QzLT4PGb/UPhgbWp7ibemJgXKveiIMsEJKiTEQ=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=YGVYyREPnn1TvjMj8rVeq+6cE7x63DeAUXS/sliBadunPEeNu8H76YsYOrE+yspJTu6VddGxS69r0sjNbwrhkLHh1ylAbHw6bruszb7SBU/xHmQ02PundTd9fPlFenZjBUSPG7u4jpJkXmjJUYPjlbBzwLgziqRcg69QMFbAHX4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=2izpTv/N; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="2izpTv/N" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 96568C2BCB0; Fri, 8 May 2026 14:22:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1778250148; bh=a5bD/QzLT4PGb/UPhgbWp7ibemJgXKveiIMsEJKiTEQ=; h=From:To:Cc:Subject:Date:Reply-To:From; b=2izpTv/N2xXEt6S0U+otYlajcTNtE22qy3RLi2FrUmGXQBbqrsguQn6W3SeZvd7aG AXp3KDnMa29qaQE+oehNrCygQPy6oXaDKNUq9Tvkvt7zIXaH/p7kXbSMk+2BU3yX9D VVxt+yq4BH+GYnMjkVGss5+bwVfKfx3yXY9vZ2Cg= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so Date: Fri, 8 May 2026 16:21:32 +0200 Message-ID: <2026050827-CVE-2026-43363-9ff7@gregkh> X-Mailer: git-send-email 2.54.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4997; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=Ng3eZwDrbXuK6HdFmAZKIgBPyzOtEUiRC5e7nTArk08=; b=kA0DAAIRMUfUDdst+ykByyZiAGn98WegMRk+VNtwHwhatMaobNsdEb2mp6HBKeLaoJgvVdESr IhdBAARAgAdFiEE9LYMxb94wiFKMT3LMUfUDdst+ykFAmn98WcACgkQMUfUDdst+ylGWgCcDtr6 xHGYyO3ptHHOOFKuHt/6dDcAoMzP7739qyanNIVNVcOAmm73bBi4 X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: x86/apic: Disable x2apic on resume if the kernel expects so When resuming from s2ram, firmware may re-enable x2apic mode, which may have been disabled by the kernel during boot either because it doesn't support IRQ remapping or for other reasons. This causes the kernel to continue using the xapic interface, while the hardware is in x2apic mode, which causes hangs. This happens on defconfig + bare metal + s2ram. Fix this in lapic_resume() by disabling x2apic if the kernel expects it to be disabled, i.e. when x2apic_mode = 0. The ACPI v6.6 spec, Section 16.3 [1] says firmware restores either the pre-sleep configuration or initial boot configuration for each CPU, including MSR state: When executing from the power-on reset vector as a result of waking from an S2 or S3 sleep state, the platform firmware performs only the hardware initialization required to restore the system to either the state the platform was in prior to the initial operating system boot, or to the pre-sleep configuration state. In multiprocessor systems, non-boot processors should be placed in the same state as prior to the initial operating system boot. (further ahead) If this is an S2 or S3 wake, then the platform runtime firmware restores minimum context of the system before jumping to the waking vector. This includes: CPU configuration. Platform runtime firmware restores the pre-sleep configuration or initial boot configuration of each CPU (MSR, MTRR, firmware update, SMBase, and so on). Interrupts must be disabled (for IA-32 processors, disabled by CLI instruction). (and other things) So at least as per the spec, re-enablement of x2apic by the firmware is allowed if "x2apic on" is a part of the initial boot configuration. [1] https://uefi.org/specs/ACPI/6.6/16_Waking_and_Sleeping.html#initialization [ bp: Massage. ] The Linux kernel CVE team has assigned CVE-2026-43363 to this issue. Affected and fixed versions =========================== Issue introduced in 2.6.28 with commit 6e1cb38a2aef7680975e71f23de187859ee8b158 and fixed in 5.10.253 with commit a6ad6f2e31b524cbb66b2f370bad0cf17d327e6c Issue introduced in 2.6.28 with commit 6e1cb38a2aef7680975e71f23de187859ee8b158 and fixed in 5.15.203 with commit 3dd0812a7c764cd8f3b0182441ac22da0a7f3b09 Issue introduced in 2.6.28 with commit 6e1cb38a2aef7680975e71f23de187859ee8b158 and fixed in 6.1.167 with commit 965289b120cc68cca886c75219c68b8c15751d73 Issue introduced in 2.6.28 with commit 6e1cb38a2aef7680975e71f23de187859ee8b158 and fixed in 6.6.130 with commit f591938072115bf08730b8530c67fab189cc6308 Issue introduced in 2.6.28 with commit 6e1cb38a2aef7680975e71f23de187859ee8b158 and fixed in 6.12.78 with commit 1a85f84214f9d790216547ac6086bf8033cd9e5a Issue introduced in 2.6.28 with commit 6e1cb38a2aef7680975e71f23de187859ee8b158 and fixed in 6.18.19 with commit 11712c4eb384098db4cb08792e223c818b908c1a Issue introduced in 2.6.28 with commit 6e1cb38a2aef7680975e71f23de187859ee8b158 and fixed in 6.19.9 with commit 1d8440c1e7c49715f937416ac90cf260f1f1712c Issue introduced in 2.6.28 with commit 6e1cb38a2aef7680975e71f23de187859ee8b158 and fixed in 7.0 with commit 8cc7dd77a1466f0ec58c03478b2e735a5b289b96 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-43363 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: arch/x86/kernel/apic/apic.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/a6ad6f2e31b524cbb66b2f370bad0cf17d327e6c https://git.kernel.org/stable/c/3dd0812a7c764cd8f3b0182441ac22da0a7f3b09 https://git.kernel.org/stable/c/965289b120cc68cca886c75219c68b8c15751d73 https://git.kernel.org/stable/c/f591938072115bf08730b8530c67fab189cc6308 https://git.kernel.org/stable/c/1a85f84214f9d790216547ac6086bf8033cd9e5a https://git.kernel.org/stable/c/11712c4eb384098db4cb08792e223c818b908c1a https://git.kernel.org/stable/c/1d8440c1e7c49715f937416ac90cf260f1f1712c https://git.kernel.org/stable/c/8cc7dd77a1466f0ec58c03478b2e735a5b289b96