CVE-2026-90127: virtio: rtc: time out alarm requests
In the Linux kernel, the following vulnerability has been resolved:
virtio: rtc: time out alarm requests
RTC class operations run with rtcdevice.opslock held. The virtio RTC alarm requests currently wait without a timeout for the device to return their requestq buffers.
On surprise removal, virtio-pci marks the virtqueues broken before unregistering the virtio device. If an alarm request is waiting when the device stops responding, viortcremove() blocks in viortcclassstop() while trying to acquire opslock. The request cannot complete and device removal hangs until the waiting task is signalled.
Use the same 60-second timeout as clock read requests for alarm reads, alarm programming, and alarm interrupt enable requests. The existing message reference counting keeps a timed-out request alive until a late response or device teardown.
Affected Software
Event History
Frequently Asked Questions
Under what conditions can device removal hang?
A virtio RTC alarm request must be waiting for its request buffer while the device stops responding, such as during surprise removal. Because RTC class operations hold ops_lock, removal can then block waiting for the request that cannot complete.
Which operations receive bounded waiting after the fix?
Alarm reads, alarm programming, and alarm interrupt-enable requests use a 60-second timeout, matching clock read requests. Timed-out messages remain reference-counted until a late response arrives or the device is torn down.