UBUNTU-CVE-2026-90127: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: virtio: rtc: time out alarm requests RTC class operations run with rtcdevice.opslock held. The virtio RTC alarm requests currently wait without a timeout for the device to return their requestq buffers. On surprise removal, virtio-pci marks the virtqueues broken before unregistering the virtio device. If an alarm request is waiting when the device stops responding, viortcremove() blocks in viortcclassstop() while trying to acquire opslock. The request cannot complete and device removal hangs until the waiting task is signalled. Use the same 60-second timeout as clock read requests for alarm reads, alarm programming, and alarm interrupt enable requests. The existing message reference counting keeps a timed-out request alive until a late response or device teardown.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
Apply the same 60-second timeout used for clock read requests to alarm reads, alarm programming, and alarm interrupt enable requests.
virtio RTC alarm request timeout = 60 seconds
Event History
Frequently Asked Questions
What systems are exposed to this issue?
Systems using the affected Ubuntu Linux kernel packages and a virtio RTC device are exposed. The failure scenario specifically involves surprise removal of the virtio device while an RTC alarm request is waiting for a response.
What does an attacker or triggering condition need to cause the hang?
An RTC alarm read, alarm programming, or alarm interrupt-enable request must be outstanding while the virtio RTC device stops responding, such as during surprise removal. The device removal can then block because the request waits indefinitely while RTC operations are locked.
What changes in the resolved version?
RTC alarm reads, alarm programming, and alarm interrupt-enable requests use a 60-second timeout, matching clock-read requests. Timed-out messages remain reference-counted until a late device response or teardown.