CVE-2026-80927

Received Received - Intake

Timekeeping Race Condition in Linux Kernel

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: timekeeping: Check the return value of tk_get_aux_ts64 in __do_adjtimex() If the auxiliary clock is disabled during tk_get_aux_ts64() but is enabled before tks->clock_valid is checked, then uninitialized stackdata will be used in the calculations and indirectly leaked to userspace. The same race window also exists after this change and also for the core timekeeper. But in these cases the only effect would be incorrect adjustments and this is userspace's responsibility to avoid this.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-80927

EUVD

EUVD-2026-76250

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a race condition in the timekeeping subsystem. When the auxiliary clock is disabled during a specific function call but re-enabled before a validity check, uninitialized stack data may be used in calculations and leaked to userspace.

Detection Guidance

This vulnerability involves a race condition in the Linux kernel's timekeeping subsystem. Detection requires checking kernel logs for timekeeping-related errors or warnings, particularly around auxiliary clock handling. Use commands like dmesg | grep -i timekeeping or journalctl -k | grep -i timekeeping to inspect kernel logs for anomalies.

Impact Analysis

The impact is limited to potential exposure of uninitialized memory to userspace, which could lead to information disclosure. However, the kernel notes that userspace is responsible for avoiding incorrect adjustments caused by this race condition.

Mitigation Strategies

Apply the latest Linux kernel security patches from your distribution vendor. Monitor kernel logs for timekeeping errors post-update. If auxiliary clocks are not required, disable them in kernel configuration to reduce attack surface.

Hi! I’m here to help you understand CVE-2026-80927. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70