CVE-2026-46257
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
In the Linux kernel, a vulnerability was fixed that led to an Oops error when read_current_timer was called on ARM32 platforms where SP804 was not registered as sched_clock.
Risk Assessment
Improper timer functionality may lead to system crashes, jeopardizing the stability and security of applications running on these platforms.
Recommendation
It is recommended to update the Linux kernel to a version where this vulnerability has been fixed to ensure proper timer operation on ARM32 platforms.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: clocksource/drivers/timer-sp804: Fix an Oops when read_current_timer is called on ARM32 platforms where the SP804 is not registered as the sched_clock. On SP804, the delay timer shares the same clkevt instance with sched_clock. On some platforms, when sp804_clocksource_and_sched_clock_init is called with use_sched_clock not set to 1, sched_clkevt is not properly initialized. However, sp804_register_delay_timer is invoked unconditionally, and read_current_timer() subsequently calls sp804_read on an uninitialized sched_clkevt, leading to a kernel Oops when accessing sched_clkevt->value. Declare a dedicated clkevt instance exclusively for delay timer, instead of sharing the same clkevt with sched_clock. This ensures that read_current_timer continues to work correctly regardless of whether SP804 is selected as the sched_clock.