Denial of Service Vulnerability in Linux Kernel SP804 Timer by Vendor

CVE-2026-46257

What is CVE-2026-46257?

A vulnerability in the Linux kernel related to the SP804 timer can lead to a Denial of Service condition. When read_current_timer is called on ARM32 platforms where the SP804 is not registered as the sched_clock, it can cause a kernel Oops. This issue arises because the delay timer shares the same clkevt instance with sched_clock, leading to improper initialization of the sched_clkevt and ultimately resulting in access violations. To mitigate this, it is advised to declare a distinct clkevt instance for the delay timer, ensuring reliable operation of read_current_timer across different platform configurations.

References