Linux Kernel up to 7.2.5 Samsung PWM Timer samsung_pwm locking

Summaryinfo

A vulnerability classified as very critical has been found in Linux Kernel up to 7.2.5. This affects an unknown part of the file samsung_pwm of the component Samsung PWM Timer. The manipulation leads to locking. This vulnerability is uniquely identified as CVE-2026-90208. Local access is required to approach this attack. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Linux Kernel up to 7.2.5. It has been rated as very critical. This issue affects some unknown processing of the file samsung_pwm of the component Samsung PWM Timer. The manipulation with an unknown input leads to a locking vulnerability. Using CWE to declare the problem leads to CWE-667. The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type Samsung PWM timer might be used as a clock source on some legacy systems. When PREEMPT_RT is enabled on ARM, regular spinlock is converted to a sleeping lock (mutex-based), which must not be used in atomic context such as hard interrupt handlers. Switch the samsung_pwm_lock to the raw_spinlock, which remains a true non-sleeping spinlock even under PREEMPT_RT.

It is possible to read the advisory at git.kernel.org. The identification of this vulnerability is CVE-2026-90208 since 09/11/2026. The exploitation is known to be easy. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/17/2026).

Upgrading to version 7.2.6 or 7.3-rc1 eliminates this vulnerability. Applying the patch 7eb5764d25c4ac7f5d126621660f7219b61fd2fd/3b212f9d70805d91febae01d618868f4860e267c is able to eliminate this problem. The best possible mitigation is suggested to be upgrading to the latest version.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.2.0
• 7.2.1
• 7.2.2
• 7.2.3
• 7.2.4
• 7.2.5

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion