CVE-2026-97925 - Vulnerability Details

- tick/broadcast: Plug clockevents replacement race

Description

In the Linux kernel, the following vulnerability has been resolved:

tick/broadcast: Plug clockevents replacement race

朱恺乾 reported and decoded the following race condition when a broadcast
device is replaced:

CPUA CPUB
__tick_broadcast_oneshot_control()
bc = tick_broadcast_device.evtdev;
tick_install_broadcast_device(dev)
clockevents_exchange_device(cur, dev)
shutdown(cur);
detach(cur);
cur->handler = noop;
tick_broadcast_device.evtdev = dev;

tick_broadcast_set_event(bc, next_event); <- FAIL: arms a detached device.

If the original broadcast device has a restricted interrupt affinity mask
and the last CPU in that mask goes offline then the BUG() in
tick_cleanup_dead_cpu() triggers because the clockevent device is not in
detached state.

The reason for this is that tick_install_broadcast_device() is not
serialized vs. tick broadcast operations.

The obvious cure is to serialize tick_install_broadcast_device() with
tick_broadcast_lock against a concurrent tick broadcast operation.

That requires to split clockevents_exchange_device() into two parts, one
which does the exchange, shutdown and detach operation and the other which
drops the module reference count. This is required because the module
reference cannot be dropped while holding tick_broadcast_lock.

Let clockevents_exchange_device() do both operations as before, but let the
broadcast device code take the two step approach and do the device
exchange under tick_broadcast_lock and drop the module reference count
after releasing it.

Published: 2026-09-25

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A race condition in the Linux kernel tick/broadcast code occurs when a broadcast device is replaced. The lack of serialization between tick_install_broadcast_device and ongoing broadcast operations can leave a device enabled while it has been detached. This leads to a BUG() call in tick_cleanup_dead_cpu and can trigger a kernel panic, resulting in a denial of service on the affected system.

Affected Systems

All Linux kernel installations that compile the tick/broadcast code are potentially affected. No specific kernel version is listed, so the issue may exist in older and current releases that lack the serialization fix.

Risk and Exploitability

The CVSS base score of 5.5 indicates a medium severity. The EPSS score of <1% implies a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Because the race condition requires replacement of a broadcast device or manipulation of kernel modules, the attack is limited to local privileged users. The race can still trigger a BUG() leading to a kernel panic and a denial of service; however, exploitation requires specific conditions such as offline CPUs with restricted interrupt affinity masks.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`f8381cba04ba8173fd5a2b8e5cd8b3290ee13a98`	affected	< 9fa1fb4a876e10cc17182ce339625ec4d4b75f20
`f8381cba04ba8173fd5a2b8e5cd8b3290ee13a98`	affected	< bc988724973b7f50d5dd05637f1e9ef4f009afd5
`f8381cba04ba8173fd5a2b8e5cd8b3290ee13a98`	affected	< 338d6859cd1580617807290f6d7e92b1662d4695
`f8381cba04ba8173fd5a2b8e5cd8b3290ee13a98`	affected	< 757aa9f548c18b96da1d56d11f65be8188a16d59
`f8381cba04ba8173fd5a2b8e5cd8b3290ee13a98`	affected	< 3da55616db2b6b7d9caa3b7ff1e8983224e0ed52
`f8381cba04ba8173fd5a2b8e5cd8b3290ee13a98`	affected	< 3525b94b2f258e0b99d1ee5a82a80b51bc1cc818
`f8381cba04ba8173fd5a2b8e5cd8b3290ee13a98`	affected	< 292b7a8ed84032cfdfc9076a690360f7d3f640d4
`f8381cba04ba8173fd5a2b8e5cd8b3290ee13a98`	affected	< 113a9796effe3376d2ec5aabcca1fef4fef4cd62

Linux

affected

Version	Status	Constraints
`2.6.21`	affected	—
`0`	unaffected	< 2.6.21
`5.10.273`	unaffected	≤ 5.10.*
`5.15.224`	unaffected	≤ 5.15.*
`6.1.189`	unaffected	≤ 6.1.*
`6.6.158`	unaffected	≤ 6.6.*
`6.12.111`	unaffected	≤ 6.12.*
`6.18.53`	unaffected	≤ 6.18.*
`7.2.7`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[f8381cba04ba8173fd5a2b8e5cd8b3290ee13a98,3da55616db2b6b7d9caa3b7ff1e8983224e0ed52)`	affected	code_commit	—
`[f8381cba04ba8173fd5a2b8e5cd8b3290ee13a98,3525b94b2f258e0b99d1ee5a82a80b51bc1cc818)`	affected	code_commit	—
`[f8381cba04ba8173fd5a2b8e5cd8b3290ee13a98,292b7a8ed84032cfdfc9076a690360f7d3f640d4)`	affected	code_commit	—
`[f8381cba04ba8173fd5a2b8e5cd8b3290ee13a98,113a9796effe3376d2ec5aabcca1fef4fef4cd62)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.21`	affected	semver	—
`[0,2.6.21)`	unaffected	semver	—
`[6.12.111,6.13.0)`	unaffected	semver	—
`[6.18.53,6.19.0)`	unaffected	semver	—
`[7.2.7,7.3.0)`	unaffected	semver	—
`[7.3-rc3,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply a kernel update that includes the synchronization fix for broadcast device replacement
Ensure that any custom clockevents modules are loaded only after the system is fully booted and no CPUs with restricted affinity masks are sleeping
If a patch is not yet available, avoid replacing broadcast devices while CPUs are offline or have restricted interrupt affinity masks
Monitor the system for BUG() or kernel panic logs and apply the patch as soon as it is released

Generated by OpenCVE AI on October 1, 2026 at 05:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DLA	DLA-4841-1	linux security update
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00206.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97925.mbox
https://git.kernel.org/stable/c/113a9796effe3376d2ec5aabcca1fef4fef4cd62
https://git.kernel.org/stable/c/292b7a8ed84032cfdfc9076a690360f7d3f640d4
https://git.kernel.org/stable/c/338d6859cd1580617807290f6d7e92b1662d4695
https://git.kernel.org/stable/c/3525b94b2f258e0b99d1ee5a82a80b51bc1cc818
https://git.kernel.org/stable/c/3da55616db2b6b7d9caa3b7ff1e8983224e0ed52
https://git.kernel.org/stable/c/757aa9f548c18b96da1d56d11f65be8188a16d59
https://git.kernel.org/stable/c/9fa1fb4a876e10cc17182ce339625ec4d4b75f20
https://git.kernel.org/stable/c/bc988724973b7f50d5dd05637f1e9ef4f009afd5
https://nvd.nist.gov/vuln/detail/CVE-2026-97925
https://www.cve.org/CVERecord?id=CVE-2026-97925

History

Fri, 30 Oct 2026 12:45:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/9fa1fb4a876e10cc17182ce339625ec4d4b75f20 https://git.kernel.org/stable/c/bc988724973b7f50d5dd05637f1e9ef4f009afd5

Sat, 03 Oct 2026 11:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/338d6859cd1580617807290f6d7e92b1662d4695 https://git.kernel.org/stable/c/757aa9f548c18b96da1d56d11f65be8188a16d59

Wed, 30 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-366
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97925.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-97925 https://www.cve.org/CVERecord?id=CVE-2026-97925
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 25 Sep 2026 10:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: tick/broadcast: Plug clockevents replacement race 朱恺乾 reported and decoded the following race condition when a broadcast device is replaced: CPUA CPUB __tick_broadcast_oneshot_control() bc = tick_broadcast_device.evtdev; tick_install_broadcast_device(dev) clockevents_exchange_device(cur, dev) shutdown(cur); detach(cur); cur->handler = noop; tick_broadcast_device.evtdev = dev; tick_broadcast_set_event(bc, next_event); <- FAIL: arms a detached device. If the original broadcast device has a restricted interrupt affinity mask and the last CPU in that mask goes offline then the BUG() in tick_cleanup_dead_cpu() triggers because the clockevent device is not in detached state. The reason for this is that tick_install_broadcast_device() is not serialized vs. tick broadcast operations. The obvious cure is to serialize tick_install_broadcast_device() with tick_broadcast_lock against a concurrent tick broadcast operation. That requires to split clockevents_exchange_device() into two parts, one which does the exchange, shutdown and detach operation and the other which drops the module reference count. This is required because the module reference cannot be dropped while holding tick_broadcast_lock. Let clockevents_exchange_device() do both operations as before, but let the broadcast device code take the two step approach and do the device exchange under tick_broadcast_lock and drop the module reference count after releasing it.
Title		tick/broadcast: Plug clockevents replacement race
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/113a9796effe3376d2ec5aabcca1fef4fef4cd62 https://git.kernel.org/stable/c/292b7a8ed84032cfdfc9076a690360f7d3f640d4 https://git.kernel.org/stable/c/3525b94b2f258e0b99d1ee5a82a80b51bc1cc818 https://git.kernel.org/stable/c/3da55616db2b6b7d9caa3b7ff1e8983224e0ed52

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-25T10:22:43.552Z

Updated: 2026-10-30T12:37:44.697Z

Reserved: 2026-09-25T10:18:58.202Z

Link: CVE-2026-97925

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-25T11:17:19.680

Modified: 2026-10-30T13:21:10.607

Link: CVE-2026-97925

Redhat

Severity : Moderate

Publid Date: 2026-09-25T00:00:00Z

Links: CVE-2026-97925 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-01T05:45:17Z

Weaknesses

CWE-366
Race Condition within a Thread

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object