Cloudanix VulnDB

CVE-2026-90304

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel used on certain processors can make real-time systems unstable when programs trigger specific errors.

Exploitation
Requires User Interaction
Attacker needs
Local User
Complexity
Low
Impact
Other
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

In the Linux kernel on ARM, do_DataAbort and do_PrefetchAbort can invoke force_sig_fault with interrupts disabled on unhandled user faults (such as those from the bkpt instruction when CONFIG_PERF_EVENTS=n), violating PREEMPT_RT expectations for signal delivery.

Why it matters to the business

Real-time Linux systems on ARM hardware may experience instability, deadlocks, or crashes under PREEMPT_RT when user-space code triggers certain faults, increasing downtime risk in latency-sensitive deployments.

How an attack unfolds

An attacker compiles and executes a user-space program containing the bkpt instruction on an affected ARM Linux kernel built with PREEMPT_RT and CONFIG_PERF_EVENTS disabled; the resulting unhandled fault path leaves interrupts disabled when force_sig_fault is reached, triggering the race condition.

How to fix it

Apply the upstream kernel commit that enables interrupts before calling force_sig_fault in the unhandled-fault paths of do_DataAbort and do_PrefetchAbort; rebuild and deploy the patched kernel on all affected ARM PREEMPT_RT systems.

How to confirm the fix worked

Boot the patched kernel, run a test program that executes bkpt to force an unhandled fault, and confirm that interrupts remain enabled and no deadlock occurs; inspect kernel source for the interrupt-enable change prior to force_sig_fault.

Typical attack path

  1. Identify or build ARM Linux system running PREEMPT_RT with CONFIG_PERF_EVENTS=n
  2. Execute user program containing bkpt instruction to induce data or prefetch abort
  3. Trigger unhandled fault path in do_DataAbort or do_PrefetchAbort
  4. Observe kernel instability or deadlock due to disabled interrupts during signal delivery

How to detect it

Review kernel logs for unexpected deadlocks or signal-delivery failures on ARM PREEMPT_RT systems; correlate timestamps of user-space bkpt executions with kernel oops or hung-task reports; no widespread exploit artifacts are known.

What your security team should do

  • Prioritize patching ARM PREEMPT_RT kernels within the next maintenance window
  • Audit kernel configs for CONFIG_PERF_EVENTS=n on real-time ARM deployments
  • Monitor for new kernel releases containing the interrupt-enable fix
  • Test patched kernels in staging environments that reproduce bkpt fault paths

The record

In the Linux kernel, the following vulnerability has been resolved: ARM: 9484/1: enable interrupts when unhandled user faults are triggered PREEMPT_RT requires interrupts to be enabled when sending signals. When do_DataAbort()/do_PrefetchAbort() triggers unhandled user faults, that is `inf->fn()` return a non-zero value, and the interrupts are not enabled within the hook function, force_sig_fault() will be called with interrupts disabled. This can be triggered by user programs executing the bkpt instruction, with kernel config CONFIG_PERF_EVENTS=n. Enable interrupts in do_DataAbort()/do_PrefetchAbort() when unhandled user faults are triggered to fix the issue.

Affected packages

Ecosystem Package Introduced Fixed