Technical impact
The Linux kernel bug is triggered when the auxiliary clock is disabled during the tk_get_aux_ts64() call but enabled again before the tks->clock_valid field is examined. This race condition causes uninitialized stack data to be involved in time calculations, which can indirectly leak data to userspace. The same race window also exists after the change in the core timekeeper, but the only effect there is incorrect time adjustments, which userspace must handle. Consequently, the primary security impact of the vulnerability is an information leak through uninitialized data, not code execution or denial of service.
Affected Systems
All Linux kernel builds that contain the unpatched tk_get_aux_ts64 logic are affected. Because the applies to any kernel in which the described race condition still exists.
Risk and Exploitability
With a CVSS score of 2.8, the vulnerability is considered low severity. The EPSS score is < 1%, and the vulnerability is not listed initation would require a local attacker who can manipulate the auxiliary clock timing to create the race condition, making it a relatively narrow attack vector that does not provide remote or privilege escalation capabilities.
Ubuntu USN