Executive brief
The Linux kernel's machine check exception (MCE) error detection system for x86 processors has a timing bug in how it initializes its polling timer during boot. When CMCI (Corrected Machine Check Interrupt) storm detection runs, it attempts to use a timer that hasn't been set up yet, triggering kernel warnings and debug object assertion errors. This could lead to kernel instability or crashes on affected systems during boot.
Technical details
The vulnerability is a race condition in the x86 MCE subsystem's initialization sequence. The mcheck_cpu_init() function was calling __mcheck_cpu_setup_timer() after __mcheck_cpu_init_vendor(), which invokes intel_init_cmci() and cmci_discover(). These functions attempt to modify the MCE polling timer via mce_timer_kick() before the timer has been initialized with timer_setup(), causing ODEBUG assertions to fire and the timer to be queued twice. The fix reorders the initialization to call __mcheck_cpu_setup_timer() first, since it has no dependencies on the generic or vendor-specific initialization. This is a logical error with no authentication or user interaction required; the bug manifests during CPU initialization on vulnerable systems.
Affected products
- Linux Linux kernel 7.2-rc5 and likely earlier versions; patched in upstream and stable branches
Timeline
- 2026-09-03: disclosed: Published on NVD
- 2026-08-19: patched: Fix committed upstream as a213dfaa2596c1c0dc4dae91c14fbfa499c03223
- 2026-08-23: patched: Backported to stable branches via commits 17ab68d0cf6a and 4f4cba3947d2