Executive brief
The Linux kernel's debug objects subsystem contains a race condition in out-of-memory (OOM) handling that can cause timer callbacks to be invoked on uninitialized objects. This could lead to kernel instability, hangs, or crashes when debug objects are disabled due to memory pressure, affecting system reliability.
Technical details
The vulnerability is a race condition in the Linux kernel's debugobjects subsystem, specifically in debug_object_assert_init() and debug_object_activate() functions. When an out-of-memory condition occurs, debug objects are disabled and shadow objects are freed while another CPU is still performing a lookup. This causes the lookup to fail and return an error pointer, yet the fixup callback (such as stub_timer() for hrtimers) is still invoked unconditionally, operating on a non-existent shadow object. The race occurs because there is no check to verify whether debug objects remain enabled before executing the print and fixup functions. The vulnerability requires no special privileges or network access; it can occur during normal kernel operation under memory pressure.
Affected products
- Linux Linux kernel affected versions not specified
Timeline
- 2026-08-10: disclosed
- 2026-08-10: patched: Fix plugs the hole by checking whether debug objects are still enabled before invoking print and fixup functions