CVE-2026-90305: ARM: 9483/1: select HAVE_POSIX_CPU_TIMERS_TASK_WORK
In the Linux kernel, the following vulnerability has been resolved:
ARM: 9483/1: select HAVEPOSIXCPUTIMERSTASKWORK
Commit c6e61c06d606 ("ARM: 9463/1: Allow to enable RT") enabled PREEMPTRT on ARM but did not select HAVEPOSIXCPUTIMERSTASKWORK. This leaves CONFIGPOSIXCPUTIMERSTASKWORK disabled, so CPU timers expire in hard IRQ context.
On PREEMPTRT this makes runposixcputimers() take the sleeping sighand->siglock:
BUG: sleeping function called from invalid context at spinlockrt.c:48 rtspinlock from locktasksighand locktasksighand from runposixcputimers runposixcputimers from updateprocesstimes
ARM handles TIFNOTIFYRESUME on all return-to-user paths, including v7-M. ARM32 KVM host support was removed by commit 541ad0150ca4 ("arm: Remove 32bit KVM host support"), so the select need not be conditional on KVM.
Select it to defer POSIX CPU timer expiry to task context.
Reproduced with setrlimit(RLIMITCPU, ...) and a busy loop. The same path is used by setitimer(ITIMERPROF or ITIMERVIRTUAL) and POSIX CPU timers created with timercreate().
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
ARM systems running a Linux kernel with PREEMPT_RT enabled are exposed when CONFIG_POSIX_CPU_TIMERS_TASK_WORK is not selected. The issue concerns CPU timer expiration paths on ARM.
What activity can trigger the affected path?
A process can trigger it by setting RLIMIT_CPU and consuming CPU in a busy loop. The same path is used by ITIMER_PROF, ITIMER_VIRTUAL, and POSIX CPU timers created with timer_create().
What happens when the vulnerability is triggered?
CPU timers expire in hard IRQ context rather than being deferred to task context. On PREEMPT_RT, run_posix_cpu_timers() then attempts to take the sleeping sighand->siglock from an invalid context, causing a BUG.
How can I determine whether a system has encountered this issue?
Look for a kernel BUG reporting a sleeping function called from invalid context at spinlock_rt.c:48, with a stack involving rt_spin_lock, lock_task_sighand, run_posix_cpu_timers, and update_process_times.