CVE-2026-43227
Clocksource Race Condition in Linux Kernel TMU Driver
Publication date: 2026-05-06
Last updated on: 2026-05-06
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.18.0-arm64-renesas-09926-gee959e7c5e34 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves the TMU (Timer Management Unit) device driver in the Linux kernel. The TMU device acts as both a clocksource and a clockevent provider. The driver attempts to manage its power state by turning the device and its clock on and off when not in use. However, when used as an early platform device, the device is left powered on after initialization (probe), but the clock is still enabled and disabled at runtime.
The issue arises because the TMU driver uses raw spinlocks internally when registering as a clockevent provider. In this context, it cannot safely manage power or clock states using the usual runtime power management calls, which rely on regular spinlocks. This mismatch leads to lock dependency (lockdep) warnings and invalid wait contexts, especially in PREEMPT_RT (real-time) builds where normal spinlocks can sleep.
The vulnerability is that improper handling of power and clock management under these locking conditions can cause kernel warnings or potential deadlocks, affecting system stability.
How can this vulnerability impact me? :
This vulnerability can impact system stability and reliability, particularly on systems using PREEMPT_RT (real-time) Linux kernel builds. The improper locking and power management interaction can cause lockdep warnings and invalid wait contexts, which may lead to kernel deadlocks or crashes.
For non-PREEMPT_RT builds, this issue is less critical and may not cause noticeable problems. However, on real-time systems where timing and responsiveness are critical, this vulnerability could disrupt normal operation and cause system hangs or degraded performance.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability manifests as a lockdep warning related to invalid wait context in the Linux kernel, specifically involving the TMU driver and raw spinlocks.
To detect this issue on your system, you should monitor kernel logs for messages similar to the following lockdep warning:
- [ BUG: Invalid wait context ]
- swapper/0/0 is trying to lock: ffff000008c9e180 (&dev->power.lock)
You can check kernel logs using commands like:
- dmesg | grep -i 'BUG: Invalid wait context'
- journalctl -k | grep -i 'BUG: Invalid wait context'
Additionally, monitoring for lockdep warnings or stack traces involving __pm_runtime_resume and sh_tmu_clock_event_set_oneshot functions can help identify the problem.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation is to ensure that the TMU device is always left powered on and its clock running after the probe, especially in PREEMPT_RT builds.
This avoids the problematic power management calls that occur while holding raw spinlocks, which cause the lockdep warnings.
Therefore, you should verify and, if necessary, modify the TMU driver or platform device initialization to leave the device powered and clock enabled after probe.
If you are using a kernel version prior to the fix, consider updating to a version where this issue is resolved.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information about CVE-2026-43227 does not include any details regarding its impact on compliance with common standards and regulations such as GDPR or HIPAA.