Description
In the Linux kernel, the following vulnerability has been resolved:

rseq: Prevent hard lockup on granted time slice extension

__exit_to_user_mode_loop() invokes rseq_grant_timeslice_extension() with
interrupts enabled. If the extension is granted it invokes
hrtimer_rearm_deferred_tif() to ensure that a pending deferred hrtimer
rearm is handled before exiting to user space.

Though this invokes __hrtimer_rearm_deferred() which expects to be invoked
with interrupts disabled as it takes hrtimer_cpu_base::lock with
raw_spin_lock(). That's a livelock waiting to happen and caught by lockdep:

WARNING: ./include/linux/hrtimer_rearm.h:17 at irqentry_exit, CPU#1: slice_test
WARNING: inconsistent lock state
inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage.

Prevent this by disabling interrupts around the invocation of
hrtimer_rearm_deferred_tif() in rseq_grant_timeslice_extension().

[ tglx: Massaged change log ]
Published: 2026-08-26
Score: n/a
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

In the Linux kernel, the sequence that grants a time‑slice extension in the rseq subsystem incorrectly calls rseq_grant_timeslice_extension() with interrupts enabled. The routine subsequently invokes hrtimer_rearm_deferred_tif(), which is designed to run with interrupts disabled and acquires a raw_spin_lock. Because interrupts were still enabled, the lock acquisition can dead‑lock, resulting in a livelock scenario that lockdep reports as an inconsistent lock state warning. If this condition is triggered, the kernel can enter a hard lockup during a context switch, effectively crashing the system and causing a denial of service.

Affected Systems

The vulnerability exists in any Linux kernel build that does not contain the rseq patch. All distributions that ship the upstream kernel unchanged are potentially affected. No specific affected kernel version ranges are enumerated in the advisory, so any system running an older kernel lacking the fix remains vulnerable.

Risk and Exploitability

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the vulnerability requires the ability to execute code in kernel mode (e.g., via a local privilege escalation or a malicious kernel module). No publicly disclosed exploits exist, and no remote attack path is known. Consequently, the risk is limited to environments where an attacker can run code in the kernel; the likelihood of exploitation remains primarily theoretical.

Generated by OpenCVE AI on August 26, 2026 at 18:05 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Linux kernel package from your distribution that contains the rseq fix, or apply the upstream patch to your current kernel.
  • Reboot the system to load the patched kernel.
  • Monitor system logs for lockdep warnings; if a warning appears, investigate immediately and apply the patch if not already in use.

Generated by OpenCVE AI on August 26, 2026 at 18:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 26 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-362

Wed, 26 Aug 2026 14:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: rseq: Prevent hard lockup on granted time slice extension __exit_to_user_mode_loop() invokes rseq_grant_timeslice_extension() with interrupts enabled. If the extension is granted it invokes hrtimer_rearm_deferred_tif() to ensure that a pending deferred hrtimer rearm is handled before exiting to user space. Though this invokes __hrtimer_rearm_deferred() which expects to be invoked with interrupts disabled as it takes hrtimer_cpu_base::lock with raw_spin_lock(). That's a livelock waiting to happen and caught by lockdep: WARNING: ./include/linux/hrtimer_rearm.h:17 at irqentry_exit, CPU#1: slice_test WARNING: inconsistent lock state inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage. Prevent this by disabling interrupts around the invocation of hrtimer_rearm_deferred_tif() in rseq_grant_timeslice_extension(). [ tglx: Massaged change log ]
Title rseq: Prevent hard lockup on granted time slice extension
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-26T14:36:57.763Z

Reserved: 2026-08-15T05:44:03.931Z

Link: CVE-2026-74749

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-26T15:16:53.933

Modified: 2026-08-26T15:16:53.933

Link: CVE-2026-74749

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-26T18:15:08Z

Weaknesses
  • CWE-362

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')