Executive brief
The Linux kernel's rseq (restartable sequences) subsystem can experience a hard lockup when granting time slice extensions to user-space processes. A function is called with interrupts enabled but internally requires interrupts to be disabled to safely access lock-protected data, creating a potential livelock condition that can freeze the system.
Technical details
The vulnerability is a lock state inconsistency in the rseq time slice extension code. When __exit_to_user_mode_loop() calls rseq_grant_timeslice_extension() with interrupts enabled, and the extension is granted, the code invokes hrtimer_rearm_deferred_tif() which in turn calls __hrtimer_rearm_deferred(). This internal function requires interrupts to be disabled because it acquires hrtimer_cpu_base::lock with raw_spin_lock(), but is being called with interrupts still enabled. This creates a livelock condition (detected by lockdep as an inconsistent lock state warning). The fix disables interrupts around the hrtimer_rearm_deferred_tif() invocation using guard(irq)(). This is a kernel-internal synchronization bug affecting the exit path to user mode on affected kernel versions.
Affected products
- Linux Linux kernel Multiple versions from 4.x onwards (exact range varies per stable branch)
Timeline
- 2026-08-26: disclosed
- 2026-08-10: patched: Upstream fix committed; backported to stable branches by 2026-08-23