CVE-2026-90208: clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type
clocksource/drivers/samsungpwm: Switch to rawspinlockt type
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.114 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.57 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.6 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.6-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.12-1Fixed in 7.2.14-1 - Configuration
Change samsung_pwm_lock from a regular spinlock to raw_spinlock_t so it remains non-sleeping under PREEMPT_RT and is safe in hard interrupt handlers.
Linux kernel clocksource/drivers/samsung_pwm samsung_pwm_lock type = raw_spinlock_t
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel on ARM with PREEMPT_RT enabled are exposed when the Samsung PWM timer is used as a clock source, particularly on legacy systems where that timer configuration is present.
What condition triggers the vulnerability?
The issue occurs when code uses the Samsung PWM lock from an atomic context such as a hard interrupt handler. With PREEMPT_RT enabled, a regular spinlock can become a mutex-based sleeping lock, which is unsafe in that context.
Is a default kernel configuration necessarily affected?
No. The described condition requires PREEMPT_RT on ARM and use of the Samsung PWM timer as a clock source; the data does not indicate that these conditions are enabled by default.
What is the relevant remediation?
Apply the kernel change that converts samsung_pwm_lock from a regular spinlock to raw_spinlock_t. A raw spinlock remains non-sleeping under PREEMPT_RT and is suitable for hard interrupt contexts.