Executive brief
A vulnerability in the Linux kernel's timer management system can cause a system to enter a 'livelock' state, where it becomes unresponsive. This occurs because the system incorrectly handles certain internal timing events, causing it to spin indefinitely in a loop. This could lead to a complete denial of service, requiring a system reboot to recover.
Technical details
A livelock vulnerability exists in the Linux kernel's timer migration hierarchy (kernel/time/timer_migration.c). The function tmigr_handle_remote_cpu() incorrectly skipped timer_expire_remote() when the target CPU matched the current processor ID, based on the flawed assumption that local softirqs had already processed the timers. However, because jiffies can advance between the global timer handling and the remote evaluation, expired timers could be ignored while still being reported as pending. This results in an infinite loop where the event is re-queued indefinitely with an immediate expiry time. The fix involves calling timer_expire_remote() unconditionally to ensure all expired timers are processed.
Affected products
- Linux Linux 6.9 to 7.1
Timeline
- 2026-06-03: other: Patch authored
- 2026-06-25: advisory: CVE published