Linux Kernel up to 6.18.7/6.19-rc6 timekeeping include/linux/seqlock.h __do_ajdtimex state issue

Summaryinfo

A vulnerability was found in Linux Kernel up to 6.18.7/6.19-rc6. It has been classified as critical. The impacted element is the function __do_ajdtimex of the file include/linux/seqlock.h of the component timekeeping. Performing a manipulation results in state issue. This vulnerability is reported as CVE-2026-23106. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as critical, was found in Linux Kernel up to 6.18.7/6.19-rc6. This affects the function __do_ajdtimex of the file include/linux/seqlock.h of the component timekeeping. The manipulation with an unknown input leads to a state issue vulnerability. CWE is classifying the issue as CWE-371. The impact remains unknown. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: timekeeping: Adjust the leap state for the correct auxiliary timekeeper When __do_ajdtimex() was introduced to handle adjtimex for any timekeeper, this reference to tk_core was not updated. When called on an auxiliary timekeeper, the core timekeeper would be updated incorrectly. This gets caught by the lock debugging diagnostics because the timekeepers sequence lock gets written to without holding its associated spinlock: WARNING: include/linux/seqlock.h:226 at __do_adjtimex+0x394/0x3b0, CPU#2: test/125 aux_clock_adj (kernel/time/timekeeping.c:2979) __do_sys_clock_adjtime (kernel/time/posix-timers.c:1161 kernel/time/posix-timers.c:1173) do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1)) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:131) Update the correct auxiliary timekeeper.

It is possible to read the advisory at git.kernel.org. This vulnerability is uniquely identified as CVE-2026-23106 since 01/13/2026. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 05/03/2026).

The vulnerability scanner Nessus provides a plugin with the ID 297903 (Linux Distros Unpatched Vulnerability : CVE-2026-23106), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 6.18.8 or 6.19-rc7 eliminates this vulnerability. Applying the patch 8f7c9dbeaa0be5810e44d323735967d3dba9239d/e806f7dde8ba28bc72a7a0898589cac79f6362ac is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (297903) and CERT Bund (WID-SEC-2026-0324). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Affected

• Debian Linux
• Google Cloud Platform
• Amazon Linux 2
• Red Hat Enterprise Linux
• Ubuntu Linux
• SUSE Linux
• Oracle Linux
• IBM QRadar SIEM
• SUSE openSUSE
• RESF Rocky Linux
• Open Source Linux Kernel

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.18.0
• 6.18.1
• 6.18.2
• 6.18.3
• 6.18.4
• 6.18.5
• 6.18.6
• 6.18.7
• 6.19-rc1
• 6.19-rc2
• 6.19-rc3
• 6.19-rc4
• 6.19-rc5
• 6.19-rc6

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion