Skip to main content

Linux Kernel EUVDEUVD-2026-34119

| CVE-2026-46257 MEDIUM
Use of Uninitialized Resource (CWE-908)
2026-06-03 Linux GHSA-w9qv-v668-q8rf
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 09, 2026 - 20:27 vuln.today
CVSS changed
Jun 09, 2026 - 20:22 NVD
5.5 (MEDIUM)
Patch available
Jun 03, 2026 - 19:01 EUVD
CVE Published
Jun 03, 2026 - 15:49 nvd
MEDIUM 5.5
CVE Published
Jun 03, 2026 - 15:49 nvd
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

clocksource/drivers/timer-sp804: Fix an Oops when read_current_timer is called on ARM32 platforms where the SP804 is not registered as the sched_clock.

On SP804, the delay timer shares the same clkevt instance with sched_clock. On some platforms, when sp804_clocksource_and_sched_clock_init is called with use_sched_clock not set to 1, sched_clkevt is not properly initialized. However, sp804_register_delay_timer is invoked unconditionally, and read_current_timer() subsequently calls sp804_read on an uninitialized sched_clkevt, leading to a kernel Oops when accessing sched_clkevt->value.

Declare a dedicated clkevt instance exclusively for delay timer, instead of sharing the same clkevt with sched_clock. This ensures that read_current_timer continues to work correctly regardless of whether SP804 is selected as the sched_clock.

AnalysisAI

Local denial-of-service via kernel Oops in the Linux kernel SP804 timer driver on ARM32 platforms when read_current_timer() dereferences an uninitialized sched_clkevt pointer. Affected systems are those where sp804_clocksource_and_sched_clock_init is invoked without use_sched_clock=1, yet sp804_register_delay_timer is still called unconditionally - creating the conditions for a NULL/uninitialized pointer access in sp804_read(). EPSS is 0.02% (5th percentile), no KEV listing exists, and no public exploit has been identified, placing this as low operational priority outside specialized ARM32 embedded deployments.

Technical ContextAI

The SP804 is a dual-channel ARM timer IP block present in SoCs based on ARM Versatile, RealView, and related platforms, implemented in the Linux kernel at drivers/clocksource/timer-sp804.c. Prior to the fix, the delay timer and sched_clock subsystem shared a single clkevt instance (sched_clkevt). When sp804_clocksource_and_sched_clock_init() is called with use_sched_clock=0 - meaning SP804 is not chosen as the platform scheduler clock - sched_clkevt is never initialized. Despite this, sp804_register_delay_timer() is unconditionally registered, and a subsequent call to read_current_timer() invokes sp804_read(), which accesses sched_clkevt->value on the uninitialized instance, triggering a kernel panic (Oops). This is a textbook instance of CWE-908 (Use of Uninitialized Resource). The fix resolves the issue by declaring a dedicated clkevt instance exclusively for the delay timer, decoupling it from the sched_clock path entirely. The affected CPE is cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

RemediationAI

The primary fix is upgrading to Linux kernel 6.19.4 (stable) or 7.0 (mainline), both of which introduce a dedicated clkevt instance for the SP804 delay timer, eliminating the uninitialized resource dereference. The stable-branch fix commit is available at https://git.kernel.org/stable/c/693b0b594b0f278bafa784984129c0c0f988e352 and the mainline fix at https://git.kernel.org/stable/c/694921a93f3e3621e067afc545cedf6fe3b234a9. Distributions shipping ARM32 kernel builds should backport these commits to their supported kernel versions. For systems that cannot be immediately updated, a compensating control is to modify the platform's board file or device tree to set use_sched_clock=1 for the SP804 instance if the hardware supports it, which prevents the uninitialized path from being reached - though this may alter timer scheduling behavior and should be validated on the specific platform. Alternatively, disabling the SP804 delay timer registration via kernel configuration (CONFIG_ARM_SP804) eliminates the vulnerable code path at the cost of delay timer functionality. NVD advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-46257.

Same weakness CWE-908 – Use of Uninitialized Resource

View all
CVE-2011-1255 CRITICAL POC
9.3
CVE-2024-50302 MEDIUM
5.5
CVE-2024-12085 HIGH POC
7.5
CVE-2021-1104 CRITICAL POC
9.8
CVE-2021-29937 CRITICAL POC
9.8
CVE-2021-29936 CRITICAL POC
9.8
CVE-2021-26305 CRITICAL POC
9.8
CVE-2019-9641 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

EUVD-2026-34119 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy