{"id":"AZL-74309","summary":"CVE-2025-71078 affecting package kernel for versions less than 6.6.121.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/64s/slb: Fix SLB multihit issue during SLB preload\n\nOn systems using the hash MMU, there is a software SLB preload cache that\nmirrors the entries loaded into the hardware SLB buffer. This preload\ncache is subject to periodic eviction — typically after every 256 context\nswitches — to remove old entry.\n\nTo optimize performance, the kernel skips switch_mmu_context() in\nswitch_mm_irqs_off() when the prev and next mm_struct are the same.\nHowever, on hash MMU systems, this can lead to inconsistencies between\nthe hardware SLB and the software preload cache.\n\nIf an SLB entry for a process is evicted from the software cache on one\nCPU, and the same process later runs on another CPU without executing\nswitch_mmu_context(), the hardware SLB may retain stale entries. If the\nkernel then attempts to reload that entry, it can trigger an SLB\nmulti-hit error.\n\nThe following timeline shows how stale SLB entries are created and can\ncause a multi-hit error when a process moves between CPUs without a\nMMU context switch.\n\nCPU 0                                   CPU 1\n-----                                    -----\nProcess P\nexec                                    swapper/1\n load_elf_binary\n  begin_new_exc\n    activate_mm\n     switch_mm_irqs_off\n      switch_mmu_context\n       switch_slb\n       /*\n        * This invalidates all\n        * the entries in the HW\n        * and setup the new HW\n        * SLB entries as per the\n        * preload cache.\n        */\ncontext_switch\nsched_migrate_task migrates process P to cpu-1\n\nProcess swapper/0                       context switch (to process P)\n(uses mm_struct of Process P)           switch_mm_irqs_off()\n                                         switch_slb\n                                           load_slb++\n                                            /*\n                                            * load_slb becomes 0 here\n                                            * and we evict an entry from\n                                            * the preload cache with\n                                            * preload_age(). We still\n                                            * keep HW SLB and preload\n                                            * cache in sync, that is\n                                            * because all HW SLB entries\n                                            * anyways gets evicted in\n                                            * switch_slb during SLBIA.\n                                            * We then only add those\n                                            * entries back in HW SLB,\n                                            * which are currently\n                                            * present in preload_cache\n                                            * (after eviction).\n                                            */\n                                        load_elf_binary continues...\n                                         setup_new_exec()\n                                          slb_setup_new_exec()\n\n                                        sched_switch event\n                                        sched_migrate_task migrates\n                                        process P to cpu-0\n\ncontext_switch from swapper/0 to Process P\n switch_mm_irqs_off()\n  /*\n   * Since both prev and next mm struct are same we don't call\n   * switch_mmu_context(). This will cause the HW SLB and SW preload\n   * cache to go out of sync in preload_new_slb_context. Because there\n   * was an SLB entry which was evicted from both HW and preload cache\n   * on cpu-1. Now later in preload_new_slb_context(), when we will try\n   * to add the same preload entry again, we will add this to the SW\n   * preload cache and then will add it to the HW SLB. Since on cpu-0\n   * this entry was never invalidated, hence adding this entry to the HW\n   * SLB will cause a SLB multi-hit error.\n   */\nload_elf_binary cont\n---truncated---","modified":"2026-04-01T05:22:42.547476Z","published":"2026-01-13T16:16:07Z","upstream":["CVE-2025-71078"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71078"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.121.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-74309.json"}}],"schema_version":"1.7.5"}