CVE-2026-68090 in Linux
Summary
by MITRE • 08/10/2026
In the Linux kernel, the following vulnerability has been resolved:
debugobjects: Plug race against a concurrent OOM disable
syzbot reported a puzzling splat:
WARNING: kernel/time/hrtimer.c:443 at stub_timer+0xa/0x20
stub_timer() is installed as timer callback function in hrtimer_fixup_assert_init(), which is invoked when debug_object_assert_init() can't find a shadow object. In that case debug objects emits a warning about it before invoking the fixup.
Though the provided console log lacks this warning and instead has the following a few seconds before the splat:
ODEBUG: Out of memory. ODEBUG disabled
So the object was looked up in debug_object_assert_init() and the lookup failed due a concurrent out of memory situation which disabled debug objects and freed the shadow objects:
debug_object_assert_init() if (!debug_objects_enabled) return; obj = alloc(); if (!obj) {
// Out of memory debug_objects_enabled = false; free_objects(); obj = lookup_or_alloc();
// The lookup failed because the other side // removed the objects, so this returns // an error code as the object in question // is not statically initialized
if (!IS_ERR_OR_NULL(obj)) return; if (!obj) {
debug_oom(); return; }
print(...) if (!debug_objects_enabled) return;
fixup(...)
The debug object splat is skipped because debug_objects_enabled is false, but the fixup callback is invoked unconditionally, which makes the timer disfunctional.
This is only a problem in debug_object_assert_init() and debug_object_activate() as both have to handle statically initialized objects and therefore must handle the error pointer return case gracefully. All other places only handle the found/not found case and the NULL pointer return is a signal for OOM. Otherwise they get a valid shadow object.
Plug the hole by checking whether debug objects are still enabled before invoking the print and fixup function in those two places.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability described represents a race condition within the Linux kernel's debug objects subsystem that can lead to system instability and potential denial of service scenarios. This issue specifically manifests when concurrent out-of-memory conditions interact with the debug object initialization process, creating a scenario where kernel timers become dysfunctional due to improper state handling during memory allocation failures.
The technical flaw occurs in the debug_objects subsystem where the kernel attempts to handle statically initialized objects through functions like debug_object_assert_init() and debug_object_activate(). When these functions encounter a concurrent out-of-memory situation, they properly disable debug objects and free shadow objects, but fail to check whether debug objects remain enabled before proceeding with fixup operations. The race condition arises because the system checks for debug_objects_enabled after the OOM condition has been detected and processed, yet still proceeds to invoke timer callbacks and print functions that are no longer valid.
The operational impact of this vulnerability is significant as it can cause kernel panics or system crashes when the timer callback stub function stub_timer() is invoked with an invalid context. The issue specifically affects kernel/time/hrtimer.c where the timer callback mechanism fails due to improper state management during concurrent memory allocation failures. This creates a scenario where legitimate kernel operations become corrupted, potentially leading to complete system instability or denial of service conditions.
The vulnerability demonstrates characteristics similar to CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization) and aligns with ATT&CK techniques related to privilege escalation and system stability degradation. The root cause stems from inadequate state validation before executing critical operations in a multi-threaded environment where memory allocation failures can occur concurrently with object initialization processes.
The mitigation strategy involves implementing proper state checks before invoking print and fixup functions in debug_object_assert_init() and debug_object_activate() routines. This ensures that when debug objects have been disabled due to out-of-memory conditions, the system does not attempt to proceed with operations that would otherwise cause timer dysfunction or kernel instability. The fix requires checking debug_objects_enabled status immediately before any potentially problematic operations to prevent execution of code paths that assume debug objects are still active and functional.
This vulnerability highlights the importance of proper synchronization mechanisms in kernel subsystems and demonstrates how seemingly isolated memory allocation failures can cascade into broader system stability issues when not properly handled with comprehensive state validation checks. The fix essentially prevents the race condition by ensuring that all operations within the debug objects subsystem respect the current enabled/disabled state of the debugging infrastructure, thereby preventing invalid timer callbacks from being executed when the underlying system has already disabled debug object functionality due to resource constraints.