---
id: CVE-2026-90305
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ARM: 9483/1: select HAVE_POSIX_CPU_TIMERS_TASK_WORK

  Commit c6e61c06d606 ("ARM: 9463/1: Allow to enable RT") enabled PREEMPT_RT
  on ARM but did not select HAVE_POSIX_CPU…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ARM: 9483/1: select HAVE_POSIX_CPU_TIMERS_TASK_WORK

  Commit c6e61c06d606 ("ARM: 9463/1: Allow to enable RT") enabled PREEMPT_RT
  on ARM but did not select HAVE_POSIX_CPU…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= c6e61c06d6061750597e79c598acb5dead44c35b <
    8de56782d6e5ba7a9f8c820342dccde65502f93f
  - >-
    Linux >= c6e61c06d6061750597e79c598acb5dead44c35b <
    8a58a41100ea377e978d99600ec24a9bd0273662
  - Linux 7.1
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T17:17:28.163'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90305'
references:
  - url: 'https://git.kernel.org/stable/c/8a58a41100ea377e978d99600ec24a9bd0273662'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8de56782d6e5ba7a9f8c820342dccde65502f93f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-17T16:21:47.828Z'
epss: 0.00198
epssPercentile: 0.08481
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ARM: 9483/1: select HAVE_POSIX_CPU_TIMERS_TASK_WORK

Commit c6e61c06d606 ("ARM: 9463/1: Allow to enable RT") enabled PREEMPT_RT
on ARM but did not select HAVE_POSIX_CPU_TIMERS_TASK_WORK. This leaves
CONFIG_POSIX_CPU_TIMERS_TASK_WORK disabled, so CPU timers expire in hard
IRQ context.

On PREEMPT_RT this makes run_posix_cpu_timers() take the sleeping
sighand->siglock:

  BUG: sleeping function called from invalid context at spinlock_rt.c:48
    rt_spin_lock from lock_task_sighand
    lock_task_sighand from run_posix_cpu_timers
    run_posix_cpu_timers from update_process_times

ARM handles TIF_NOTIFY_RESUME on all return-to-user paths, including v7-M.
ARM32 KVM host support was removed by commit 541ad0150ca4 ("arm: Remove
32bit KVM host support"), so the select need not be conditional on KVM.

Select it to defer POSIX CPU timer expiry to task context.

Reproduced with setrlimit(RLIMIT_CPU, ...) and a busy loop. The same path
is used by setitimer(ITIMER_PROF or ITIMER_VIRTUAL) and POSIX CPU timers
created with timer_create().

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.