CVE-2026-97925

Received Received - Intake

BaseFortify

Publication date: 2026-09-25

Last updated on: 2026-10-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: tick/broadcast: Plug clockevents replacement race 朱恺乾 reported and decoded the following race condition when a broadcast device is replaced: CPUA CPUB __tick_broadcast_oneshot_control() bc = tick_broadcast_device.evtdev; tick_install_broadcast_device(dev) clockevents_exchange_device(cur, dev) shutdown(cur); detach(cur); cur->handler = noop; tick_broadcast_device.evtdev = dev; tick_broadcast_set_event(bc, next_event); <- FAIL: arms a detached device. If the original broadcast device has a restricted interrupt affinity mask and the last CPU in that mask goes offline then the BUG() in tick_cleanup_dead_cpu() triggers because the clockevent device is not in detached state. The reason for this is that tick_install_broadcast_device() is not serialized vs. tick broadcast operations. The obvious cure is to serialize tick_install_broadcast_device() with tick_broadcast_lock against a concurrent tick broadcast operation. That requires to split clockevents_exchange_device() into two parts, one which does the exchange, shutdown and detach operation and the other which drops the module reference count. This is required because the module reference cannot be dropped while holding tick_broadcast_lock. Let clockevents_exchange_device() do both operations as before, but let the broadcast device code take the two step approach and do the device exchange under tick_broadcast_lock and drop the module reference count after releasing it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-03

Generated

2026-10-15

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-97925

EUVD

EUVD-2026-86779

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	f8381cba04ba8173fd5a2b8e5cd8b3290ee13a98
Linux	Linux	f8381cba04ba8173fd5a2b8e5cd8b3290ee13a98
Linux	Linux	f8381cba04ba8173fd5a2b8e5cd8b3290ee13a98
Linux	Linux	f8381cba04ba8173fd5a2b8e5cd8b3290ee13a98
Linux	Linux	f8381cba04ba8173fd5a2b8e5cd8b3290ee13a98
Linux	Linux	f8381cba04ba8173fd5a2b8e5cd8b3290ee13a98
Linux	Linux	2.6.21

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is a race condition in the Linux kernel's tick broadcast mechanism. It occurs when a broadcast device is replaced while another CPU is trying to use it. The issue arises because the replacement process isn't properly synchronized with ongoing broadcast operations, leading to a detached device being armed and triggering a kernel bug when the last CPU in an interrupt affinity mask goes offline.

Detection Guidance

This vulnerability is specific to the Linux kernel's tick/broadcast mechanism and may not have direct detection commands. Monitor kernel logs for BUG() triggers in tick_cleanup_dead_cpu() or clockevents-related errors. Check for race conditions during CPU offline/online events.

Impact Analysis

This vulnerability could cause system instability or crashes on Linux systems using tick broadcast features. It may lead to kernel panics or unexpected behavior when CPUs go offline or broadcast devices are replaced, potentially disrupting timekeeping and scheduling operations.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA. It is a race condition in the Linux kernel's clock event handling that could cause system instability or crashes, but does not involve data exposure or privacy violations typical of compliance requirements.

Mitigation Strategies

Apply the latest Linux kernel patches addressing this race condition. Ensure tick_install_broadcast_device() is serialized with tick_broadcast_lock. Avoid unnecessary CPU offline/online operations until patched. Monitor system stability during high-load scenarios.

Hi! I’m here to help you understand CVE-2026-97925. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70