Junglewise Threat Intelligence

CVE-2026-90208: Linux kernel Samsung PWM timer spinlock context violation

CVE-2026-90208 · Severity: info · Published 2026-09-17

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

The Samsung PWM timer driver, used as a clock source on some legacy ARM systems, was using a regular spinlock in interrupt handler code. Under PREEMPT_RT, regular spinlocks become sleep-capable (mutex-based), which can cause kernel deadlocks when called from atomic contexts like hard interrupt handlers. The fix switches to a raw spinlock that remains non-sleeping even under PREEMPT_RT.

Technical details

The vulnerability is a potential deadlock in atomic context caused by using spin_lock (which can sleep under PREEMPT_RT) in the Samsung PWM clocksource driver's timer functions, which are called from interrupt handlers. The samsung_pwm_lock spinlock was used in samsung_timer_set_prescale(), samsung_timer_set_divisor(), samsung_time_stop(), and samsung_time_setup() functions without accounting for the behavior change under PREEMPT_RT kernels. The fix converts the lock to raw_spinlock_t and replaces all spin_lock_irqsave/spin_unlock_irqrestore calls with their raw_spin variants, ensuring the lock remains non-sleeping in all contexts. This is a defensive fix affecting ARM systems running PREEMPT_RT configurations.

Affected products

  • Linux Linux kernel multiple versions (affecting clocksource/drivers/samsung_pwm)

Timeline

  • 2026-09-17: disclosed
  • 2026-08-13: patched: Upstream fix committed to mainline

References

Related threats