Junglewise Threat Intelligence

CVE-2026-74749: Linux kernel hard lockup in rseq time slice extension

CVE-2026-74749 · Severity: info · CVSS 0 · Published 2026-08-26

Executive brief

The Linux kernel's rseq (restartable sequences) subsystem can experience a hard lockup when granting time slice extensions to user-space processes. A function is called with interrupts enabled but internally requires interrupts to be disabled to safely access lock-protected data, creating a potential livelock condition that can freeze the system.

Technical details

The vulnerability is a lock state inconsistency in the rseq time slice extension code. When __exit_to_user_mode_loop() calls rseq_grant_timeslice_extension() with interrupts enabled, and the extension is granted, the code invokes hrtimer_rearm_deferred_tif() which in turn calls __hrtimer_rearm_deferred(). This internal function requires interrupts to be disabled because it acquires hrtimer_cpu_base::lock with raw_spin_lock(), but is being called with interrupts still enabled. This creates a livelock condition (detected by lockdep as an inconsistent lock state warning). The fix disables interrupts around the hrtimer_rearm_deferred_tif() invocation using guard(irq)(). This is a kernel-internal synchronization bug affecting the exit path to user mode on affected kernel versions.

Affected products

  • Linux Linux kernel Multiple versions from 4.x onwards (exact range varies per stable branch)

Timeline

  • 2026-08-26: disclosed
  • 2026-08-10: patched: Upstream fix committed; backported to stable branches by 2026-08-23

References

Related threats