Linux kernel x86/mce: CMCI discovery kicks the MCE polling timer before it is initialized

Impact

On a CPU that comes up with an inherited CMCI storm - banks already signalling corrected machine-check errors when the kernel takes over from firmware - cmci_discover() calls mce_timer_kick() during mcheck_cpu_init(), before __mcheck_cpu_setup_timer() has run timer_setup(). The kernel arms an uninitialized timer_list, and timer_setup() then re-initializes a timer that is already queued; the record shows both DEBUG_OBJECTS splats from the reporter's machine. There is no attacker here - the trigger is the machine-check state of the hardware at boot, not anything a tenant can do - so treat this as a boot-time correctness bug in error handling, not a tenancy risk. It still matters on GPU hosts because those are exactly the machines that boot with corrected-error storms latched on memory or PCIe banks, and the MCE polling timer is what surfaces the corrected-error rate telling you an HBM stack or DIMM is degrading. The fix sets the timer up first.

Who can reach it

None reachable by an attacker: the path runs during early boot on the affected CPU and depends on machine-check bank state inherited from firmware. No authentication concept applies.

What to do

Pick this up with your normal stable-kernel cadence (e708fc1566eb and backports) and drain plus reboot nodes on the regular schedule - there is nothing to mitigate at runtime and no reason to open an emergency window for it, since a node that boots cleanly today is not exposed. Prioritize nodes that log 'CMCI inherited storm' at boot, as those are the ones actually hitting the path.

References

Related entries

• Linux kernel mm: folio split leaves memcg-charged page-cache xa_nodes off the shadow_nodes list_lruCVE-2026-80729 · Linux kernel mm/huge_memory (page-cache folio split, shadow_nodes list_lru accounting)Unscored
• Linux nvmet-tcp: remote initiator can trip a kernel WARN via an oversized SGL, killing panic-on-warn hostsCVE-2026-80788 · Linux kernel nvmet-tcp (NVMe-over-TCP target SGL allocation)Unscored
• Linux kernel nvmet-tcp: unbounded kernel allocation from an unauthenticated NVMe/TCP peerCVE-2026-80789 · Linux kernel nvmet-tcp (NVMe/TCP target SGL length validation)Unscored
• Linux kernel nvmet-auth: uninitialized slab sent to a remote initiator during NVMe-oF authenticationCVE-2026-80791 · Linux kernel nvmet-auth (DH-HMAC-CHAP AUTH_RECEIVE response buffer)Unscored
• Linux kernel io_uring: folio shift overflow writes past the bvec array on 16G-hugepage kernelsCVE-2026-80810 · Linux kernel io_uring/rsrc (registered-buffer folio shift in io_vec_fill_bvec)Unscored
• Linux kernel io_uring uring_cmd: iovec leak under NVMe passthrough once the alloc cache fillsCVE-2026-80811 · Linux kernel io_uring uring_cmd (async command iovec lifetime)Unscored