{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2026-80626",
  "modified": "2026-10-07T17:22:01Z",
  "upstream": [
    "CVE-2026-80626"
  ],
  "published": "2026-08-28T06:50:33Z",
  "summary": "powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/perf: fix preempt count underflow in fsl_emb_pmu_del\n\nfsl_emb_pmu_del() unconditionally calls put_cpu_var(cpu_hw_events) at\nthe 'out:' label, but only calls the matching get_cpu_var() after the\n'i < 0' early-return check. When event->hw.idx is negative the\nfunction jumps to 'out:' without having taken get_cpu_var(), and the\ntrailing put_cpu_var() then issues an unmatched preempt_enable(),\nunderflowing preempt_count.\n\nOn a CONFIG_PREEMPT=y kernel preempt_count would underflow and\neventually present as a 'scheduling while atomic' BUG.\n\nMove put_cpu_var() to pair with get_cpu_var() so the percpu access is\ncorrectly bracketed and the 'out:' label only handles perf_pmu_enable.",
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.178",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-80626"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/c0c7722308c5f303117d8bd555290fdf26b098da"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/67aeb1eb93d4ffd898a3e74a7f3fe46ee71feb28"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/9a515e00b00132b6fc3f1dd62dc5204bbda8cb10"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/5397142d60aa29dcf636f5459d960bfc4f97c42a"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/b89477077c834d94381c7bf07d81193bebefcff9"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/73711688479df333acc134e3730fff1acba1843e"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/b504fd953664c3f4d176ae8cb594adb3fda9d577"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/81e3a86030462824a67d697739cf3f387f4ba350"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-28T06:50:33Z"
  }
}