CVE-2026-23106: timekeeping: Adjust the leap state for the correct auxiliary timekeeper
In the Linux kernel, the following vulnerability has been resolved:
timekeeping: Adjust the leap state for the correct auxiliary timekeeper
When doajdtimex() was introduced to handle adjtimex for any timekeeper, this reference to tkcore was not updated. When called on an auxiliary timekeeper, the core timekeeper would be updated incorrectly.
This gets caught by the lock debugging diagnostics because the timekeepers sequence lock gets written to without holding its associated spinlock:
WARNING: include/linux/seqlock.h:226 at doadjtimex+0x394/0x3b0, CPU#2: test/125 auxclockadj (kernel/time/timekeeping.c:2979) dosysclockadjtime (kernel/time/posix-timers.c:1161 kernel/time/posix-timers.c:1173) dosyscall64 (arch/x86/entry/syscall64.c:63 (discriminator 1) arch/x86/entry/syscall64.c:94 (discriminator 1)) entrySYSCALL64afterhwframe (arch/x86/entry/entry64.S:131)
Update the correct auxiliary timekeeper.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23106?
CVE-2026-23106 is considered a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2026-23106?
To fix CVE-2026-23106, you should update to the latest version of the Linux kernel that includes the patches for this vulnerability.
What systems are affected by CVE-2026-23106?
CVE-2026-23106 affects all versions of the Linux kernel that were impacted by the improper handling of timekeeping adjustments.
What are the potential impacts of CVE-2026-23106?
The potential impacts of CVE-2026-23106 include incorrect timekeeping which could lead to system instability and other issues.
Is CVE-2026-23106 being actively exploited?
As of now, there are no reports indicating that CVE-2026-23106 is being actively exploited in the wild.