Executive brief
The Linux kernel on ARM processors with PREEMPT_RT enabled does not properly defer POSIX CPU timer expiry from interrupt context to task context, causing the system to attempt acquiring a sleeping lock during hard IRQ handling. This results in system hangs or crashes when CPU timers expire (via setrlimit, setitimer, or timer_create calls).
Technical details
The vulnerability is a missing kernel configuration selection in the ARM architecture code. When commit c6e61c06d606 enabled PREEMPT_RT support on ARM, it failed to select HAVE_POSIX_CPU_TIMERS_TASK_WORK, leaving CONFIG_POSIX_CPU_TIMERS_TASK_WORK disabled. This causes POSIX CPU timer expiry to occur in hard IRQ context instead of being deferred to task context. On PREEMPT_RT systems, the run_posix_cpu_timers() function attempts to acquire sighand->siglock (a sleeping spinlock), triggering a "sleeping function called from invalid context" BUG. The issue is triggered by any CPU timer expiry mechanism: setrlimit(RLIMIT_CPU), setitimer(ITIMER_PROF/ITIMER_VIRTUAL), or timer_create(). The fix is a simple one-line kernel configuration selection to defer timer expiry to task context, available upstream and in stable branches.
Affected products
- Linux Linux kernel ARM architecture with PREEMPT_RT enabled (introduced in commit c6e61c06d606)
Timeline
- 2026-09-17: disclosed: CVE-2026-90305 published
- 2026-08-05: patched: Fix merged upstream (commit 8a58a41100ea)