Executive brief
A stability issue was identified in the Linux kernel affecting certain ARM-based systems. Under specific configurations, the system's internal timer could attempt to access uninitialized memory, leading to a system crash (kernel Oops). This primarily impacts system availability and reliability on affected hardware.
Technical details
A NULL pointer dereference (kernel Oops) exists in the SP804 timer driver for ARM32 platforms. The vulnerability occurs when 'read_current_timer' is called on systems where the SP804 is not registered as the 'sched_clock'. In this scenario, the 'sched_clkevt' instance remains uninitialized, but 'sp804_register_delay_timer' is still invoked. Subsequent calls to 'sp804_read' attempt to access 'sched_clkevt->value', triggering the crash. The fix involves decoupling the delay timer from the 'sched_clock' instance by declaring a dedicated 'clkevt' instance for the delay timer.
Affected products
- Linux Linux Kernel ARM32 platforms using SP804 timer
Timeline
- 2025-12-25: other: Initial patch authored
- 2026-06-03: advisory: CVE published by NVD