{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-46257", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-13T15:03:33.108Z", "datePublished": "2026-06-03T15:49:54.286Z", "dateUpdated": "2026-06-03T15:49:54.286Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-06-03T15:49:54.286Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclocksource/drivers/timer-sp804: Fix an Oops when read_current_timer is called on ARM32 platforms where the SP804 is not registered as the sched_clock.\n\nOn SP804, the delay timer shares the same clkevt instance with\nsched_clock. On some platforms, when\nsp804_clocksource_and_sched_clock_init is called with use_sched_clock\nnot set to 1, sched_clkevt is not properly initialized. However,\nsp804_register_delay_timer is invoked unconditionally, and\nread_current_timer() subsequently calls sp804_read on an uninitialized\nsched_clkevt, leading to a kernel Oops when accessing\nsched_clkevt->value.\n\nDeclare a dedicated clkevt instance exclusively for delay timer,\ninstead of sharing the same clkevt with sched_clock. This ensures\nthat read_current_timer continues to work correctly regardless of\nwhether SP804 is selected as the sched_clock."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/clocksource/timer-sp804.c"], "versions": [{"version": "640594a04f119338019b0aeed70c7301216595b3", "lessThan": "693b0b594b0f278bafa784984129c0c0f988e352", "status": "affected", "versionType": "git"}, {"version": "640594a04f119338019b0aeed70c7301216595b3", "lessThan": "694921a93f3e3621e067afc545cedf6fe3b234a9", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/clocksource/timer-sp804.c"], "versions": [{"version": "6.19", "status": "affected"}, {"version": "0", "lessThan": "6.19", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.4", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "6.19.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/693b0b594b0f278bafa784984129c0c0f988e352"}, {"url": "https://git.kernel.org/stable/c/694921a93f3e3621e067afc545cedf6fe3b234a9"}], "title": "clocksource/drivers/timer-sp804: Fix an Oops when read_current_timer is called on ARM32 platforms where the SP804 is not registered as the sched_clock.", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "672A3E79-EC03-479D-8503-361DFBDC8092", "versionEndExcluding": "6.19.4", "versionStartIncluding": "6.19", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclocksource/drivers/timer-sp804: Fix an Oops when read_current_timer is called on ARM32 platforms where the SP804 is not registered as the sched_clock.\n\nOn SP804, the delay timer shares the same clkevt instance with\nsched_clock. On some platforms, when\nsp804_clocksource_and_sched_clock_init is called with use_sched_clock\nnot set to 1, sched_clkevt is not properly initialized. However,\nsp804_register_delay_timer is invoked unconditionally, and\nread_current_timer() subsequently calls sp804_read on an uninitialized\nsched_clkevt, leading to a kernel Oops when accessing\nsched_clkevt->value.\n\nDeclare a dedicated clkevt instance exclusively for delay timer,\ninstead of sharing the same clkevt with sched_clock. This ensures\nthat read_current_timer continues to work correctly regardless of\nwhether SP804 is selected as the sched_clock."}], "id": "CVE-2026-46257", "lastModified": "2026-06-09T20:10:20.093", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-06-03T18:16:26.733", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/693b0b594b0f278bafa784984129c0c0f988e352"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/694921a93f3e3621e067afc545cedf6fe3b234a9"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-908"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: clocksource/drivers/timer-sp804: Fix an Oops when read_current_timer is called on ARM32 platforms where the SP804 is not registered as the sched_clock", "id": "2484468", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484468"}, "csaw": false, "cwe": "CWE-824", "details": ["A flaw was found in the Linux kernel's SP804 timer driver. On ARM32 platforms where the SP804 is not registered as the scheduling clock, the delay timer's clock event instance may not be properly initialized. This can lead to a kernel Oops, which is a system crash, when the system attempts to read from the uninitialized timer. This vulnerability could allow a local attacker to cause a Denial of Service (DoS) on the affected system."], "name": "CVE-2026-46257", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-06-03T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-46257\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-46257\nhttps://lore.kernel.org/linux-cve-announce/2026060335-CVE-2026-46257-6295@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[640594a04f119338019b0aeed70c7301216595b3,693b0b594b0f278bafa784984129c0c0f988e352)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[640594a04f119338019b0aeed70c7301216595b3,694921a93f3e3621e067afc545cedf6fe3b234a9)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.4,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-06-03T18:45:40.187656+00:00", "updated": "2026-06-09T22:30:14.747264+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-665", "CWE-824", "CWE-908"]}