CVE-2026-98396: Linux kernel · powerpc: Do not restore KUAP in arch_exit_to_user_mode_prepare()
Affects Linux kernelSource CVE Database V5
Not known to be exploited : upgrade to c2549d749539487239475fbc8c614a1f9244d655 or c8e80c19c3b9c8db83a14fab00445a6064992442 when convenient.
Data as of 26 Oct 2026, 14:05 UTC
Rated Low by Threat Radar's AI analysis · CVSS not yet scored by NVD
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 9% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in c2549d749539487239475fbc8c614a1f9244d655, c8e80c19c3b9c8db83a14fab00445a6064992442
Exploitation evidence
Disclosed: evidence found.
CVE published 14 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade Linux kernel to c2549d749539487239475fbc8c614a1f9244d655 or c8e80c19c3b9c8db83a14fab00445a6064992442.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in– |
AI-suggested
A fix is available and has been applied in Linux kernel commits c2549d749539487239475fbc8c614a1f9244d655 and c8e80c19c3b9c8db83a14fab00445a6064992442. Users and administrators should update to these fixed kernel versions or later to remediate the issue. No additional mitigation steps are required beyond applying the official patch.
Description
CVE-2026-98396 is a vulnerability in the Linux kernel's PowerPC architecture code where the kernel incorrectly restores the Kernel User Access Protection (KUAP) state too early during the transition from kernel mode to user mode. This premature restoration can cause warnings and potential instability when KUAP debug is enabled. The issue arises because the kernel restores user AMR (Authority Mask Register) state before platform-specific exit routines complete, which is incorrect for PowerPC. The vulnerability has been fixed in specific Linux kernel commits.