CVE-2026-72154

CVE-2026-72154 is a cache coherency failure in OpenRISC's jump_label implementation. The bug: static_branch_enable() calls kick_all_cpus_sync() but never invalidates the instruction cache. On SMP systems with non-WRITETHROUGH caches, this leaves stale instructions in the icache after a static key transition, meaning the kernel may execute the old code path while believing the new one is active. This is not a logic error — it's an architectural constraint violation. The developer copied the arm64 jump_label implementation and assumed kick_all_cpus_sync() handled icache coherency. It doesn't on OpenRISC. The function name implies universal CPU synchronization, but OpenRISC's implementation doesn't invalidate icache lines as a side effect. You need an explicit icache_all_inv() call. The bug only triggers under specific conditions: SMP (multiple cores), non-WRITETHROUGH cache configuration, and enough enable/disable cycles to fill the icache with stale sequences. This is why it went undetected for years — UP builds and emulators don't expose it, and most OpenRISC development happens on single-core simulators. The fix requires adding the architecture-specific icache invalidation call in the OpenRISC static_branch_enable() path. Check your arch's equivalent of icache_all_inv() and ensure it's called after smp_call_function() completes. This is a three-line fix in arch/openrisc/kernel/jump_label.c, but the diagnosis required understanding OpenRISC's memory model details that aren't obvious from function names or generic documentation. If you're maintaining any architecture port, audit any code copied from another arch that deals with SMP synchronization or cache management. The abstraction layer (smp_call_function, kick_all_cpus_sync) looks identical across architectures, but the hardware semantics diverge on exactly the details that matter. Assume nothing about cache coherency semantics when porting — verify each function's implementation against your target architecture's memory model.

Reviewed through automated stages and approved by a human before publication.