Executive brief
The Linux kernel's jiffies clocksource was being used before it was formally registered during early boot, causing initialization values to remain at zero. This prevented the system's time-keeping mechanism from functioning correctly, resulting in extended boot delays and halted time progression on systems like XEN HVMs. A patch ensures the clocksource is registered before first use, restoring normal boot performance.
Technical details
The vulnerability is a use-before-initialization issue in kernel/time/jiffies.c where the jiffies clocksource was accessed before its registration completed. The jiffies clocksource had a core_initcall registration that ran after the clocksource_default_clock() function was first invoked during timekeeping_init(), leaving max_delta_raw at zero. This caused all time readings to be clamped to a delta of 0, halting time progression. The fix moves clocksource registration into clocksource_default_clock() itself, ensuring initialization before first use. This is not a security vulnerability in the traditional sense but rather a kernel functionality defect introduced by prior negative motion detection enhancements.
Affected products
- Linux Linux kernel 2.6.11 through 7.2 (affected versions across stable branches)
Timeline
- 2026-08-10: disclosed
- 2026-07-18: patched: Fix committed by Thomas Gleixner and backported to stable branches