Cloudanix VulnDB

CVE-2026-90305

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A configuration mistake in the Linux kernel for certain real-time ARM systems can make the computer crash when programs use CPU timers.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Misconfiguration
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Missing kernel config select leaves CONFIG_POSIX_CPU_TIMERS_TASK_WORK disabled on ARM PREEMPT_RT, so POSIX CPU timers expire in hard IRQ context and attempt to take sleeping locks such as sighand->siglock.

Why it matters to the business

Real-time ARM systems can suffer kernel crashes or instability during normal use of CPU timers, profiling timers, or resource limits, interrupting time-sensitive workloads and requiring reboots.

How an attack unfolds

An attacker runs unprivileged code that arms CPU timers via setrlimit, setitimer, or timer_create and then triggers expiry; the resulting run_posix_cpu_timers call attempts a sleeping lock from IRQ context and hits the BUG.

How to fix it

Rebuild the kernel with the select HAVE_POSIX_CPU_TIMERS_TASK_WORK added for PREEMPT_RT on ARM; apply the referenced commit that adds the unconditional select.

How to confirm the fix worked

Inspect .config for HAVE_POSIX_CPU_TIMERS_TASK_WORK=y when PREEMPT_RT is enabled; boot the kernel and confirm no BUG messages appear when exercising setitimer or RLIMIT_CPU.

Typical attack path

  1. Execute user-space code that calls setrlimit(RLIMIT_CPU) or setitimer(ITIMER_PROF/ITIMER_VIRTUAL)
  2. Enter a busy loop or workload that causes timer expiry
  3. Trigger run_posix_cpu_timers from update_process_times in hard IRQ context
  4. Acquire sleeping siglock and hit BUG in spinlock_rt.c

How to detect it

Search kernel logs and dmesg for strings indicating sleeping function called from invalid context during run_posix_cpu_timers or update_process_times on ARM PREEMPT_RT builds.

  • sleeping function called from invalid context at spinlock_rt.c:48
  • rt_spin_lock from lock_task_sighand
  • lock_task_sighand from run_posix_cpu_timers
  • run_posix_cpu_timers from update_process_times

What your security team should do

  • Apply the config fix and rebuild affected ARM PREEMPT_RT kernels immediately
  • Add kernel config validation to CI builds for real-time ARM targets
  • Monitor kernel logs for sleeping-function-in-invalid-context BUGs on production RT systems

The record

In the Linux kernel, the following vulnerability has been resolved: ARM: 9483/1: select HAVE_POSIX_CPU_TIMERS_TASK_WORK Commit c6e61c06d606 ("ARM: 9463/1: Allow to enable RT") enabled PREEMPT_RT on ARM but did not select HAVE_POSIX_CPU_TIMERS_TASK_WORK. This leaves CONFIG_POSIX_CPU_TIMERS_TASK_WORK disabled, so CPU timers expire in hard IRQ context. On PREEMPT_RT this makes run_posix_cpu_timers() take the sleeping sighand->siglock: BUG: sleeping function called from invalid context at spinlock_rt.c:48 rt_spin_lock from lock_task_sighand lock_task_sighand from run_posix_cpu_timers run_posix_cpu_timers from update_process_times ARM handles TIF_NOTIFY_RESUME on all return-to-user paths, including v7-M. ARM32 KVM host support was removed by commit 541ad0150ca4 ("arm: Remove 32bit KVM host support"), so the select need not be conditional on KVM. Select it to defer POSIX CPU timer expiry to task context. Reproduced with setrlimit(RLIMIT_CPU, ...) and a busy loop. The same path is used by setitimer(ITIMER_PROF or ITIMER_VIRTUAL) and POSIX CPU timers created with timer_create().

Affected packages

Ecosystem Package Introduced Fixed