{"id":"CVE-2026-90305","revision":"a0163928089a4726a1531bc8e3af58ad","records":[{"revision":"a0163928089a4726a1531bc8e3af58ad","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-90305","aliases":[],"title":"ARM: 9483/1: select HAVE_POSIX_CPU_TIMERS_TASK_WORK","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nARM: 9483/1: select HAVE_POSIX_CPU_TIMERS_TASK_WORK\n\nCommit c6e61c06d606 (\"ARM: 9463/1: Allow to enable RT\") enabled PREEMPT_RT\non ARM but did not select HAVE_POSIX_CPU_TIMERS_TASK_WORK. This leaves\nCONFIG_POSIX_CPU_TIMERS_TASK_WORK disabled, so CPU timers expire in hard\nIRQ context.\n\nOn PREEMPT_RT this makes run_posix_cpu_timers() take the sleeping\nsighand->siglock:\n\n  BUG: sleeping function called from invalid context at spinlock_rt.c:48\n    rt_spin_lock from lock_task_sighand\n    lock_task_sighand from run_posix_cpu_timers\n    run_posix_cpu_timers from update_process_times\n\nARM handles TIF_NOTIFY_RESUME on all return-to-user paths, including v7-M.\nARM32 KVM host support was removed by commit 541ad0150ca4 (\"arm: Remove\n32bit KVM host support\"), so the select need not be conditional on KVM.\n\nSelect it to defer POSIX CPU timer expiry to task context.\n\nReproduced with setrlimit(RLIMIT_CPU, ...) and a busy loop. The same path\nis used by setitimer(ITIMER_PROF or ITIMER_VIRTUAL) and POSIX CPU timers\ncreated with timer_create().","state":0,"publishedAt":"2026-09-17T16:08:27.742+00:00","modifiedAt":"2026-10-19T09:01:23.094+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"arch/arm/Kconfig\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"c6e61c06d6061750597e79c598acb5dead44c35b\",\n                            \"lessThan\": \"8de56782d6e5ba7a9f8c820342dccde65502f93f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c6e61c06d6061750597e79c598acb5dead44c35b\",\n                            \"lessThan\": \"8a58a41100ea377e978d99600ec24a9bd0273662\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"arch/arm/Kconfig\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"7.1\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"7.1\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.6\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/8de56782d6e5ba7a9f8c820342dccde65502f93f","https://git.kernel.org/stable/c/8a58a41100ea377e978d99600ec24a9bd0273662"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-90305","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-90305","identifiers":["CVE-2026-90305"]},"retained":false,"historicalAffected":[]}],"coverage":[]}