Linux Kernel up to 7.1.9 rseq hrtimer_rearm.h rseq_grant_timeslice_extension race condition

Summaryinfo

A vulnerability classified as critical was found in Linux Kernel up to 7.1.9. The affected element is the function rseq_grant_timeslice_extension of the file include/linux/hrtimer_rearm.h of the component rseq. The manipulation results in race condition. This vulnerability was named CVE-2026-74749. The attack needs to be approached locally. There is no available exploit.

Detailsinfo

A vulnerability was found in Linux Kernel up to 7.1.9. It has been classified as critical. Affected is the function rseq_grant_timeslice_extension of the file include/linux/hrtimer_rearm.h of the component rseq. The manipulation with an unknown input leads to a race condition vulnerability. CWE is classifying the issue as CWE-362. The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently. This is going to have an impact on availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: rseq: Prevent hard lockup on granted time slice extension __exit_to_user_mode_loop() invokes rseq_grant_timeslice_extension() with interrupts enabled. If the extension is granted it invokes hrtimer_rearm_deferred_tif() to ensure that a pending deferred hrtimer rearm is handled before exiting to user space. Though this invokes __hrtimer_rearm_deferred() which expects to be invoked with interrupts disabled as it takes hrtimer_cpu_base::lock with raw_spin_lock(). That's a livelock waiting to happen and caught by lockdep: WARNING: ./include/linux/hrtimer_rearm.h:17 at irqentry_exit, CPU#1: slice_test WARNING: inconsistent lock state inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage. Prevent this by disabling interrupts around the invocation of hrtimer_rearm_deferred_tif() in rseq_grant_timeslice_extension(). [ tglx: Massaged change log ]

The advisory is shared for download at git.kernel.org. This vulnerability is traded as CVE-2026-74749 since 08/15/2026. The exploitability is told to be easy. The attack needs to be approached locally. There are known technical details, but no exploit is available.

Upgrading to version 7.1.10 eliminates this vulnerability. Applying the patch 8bbf4405050bc4f98be68082a20efa081ea8ad9b/ada54c2ba652348c590d1ace6a2f4ff77cbbf809 is able to eliminate this problem.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.1.0
• 7.1.1
• 7.1.2
• 7.1.3
• 7.1.4
• 7.1.5
• 7.1.6
• 7.1.7
• 7.1.8
• 7.1.9

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion