GHSA-5FMR-WWGG-GFQM
Vulnerability from github – Published: 2026-09-03 15:32 – Updated: 2026-09-03 15:32In the Linux kernel, the following vulnerability has been resolved:
x86/mce: Set up the polling timer before CMCI discovery
I hit the following on one of my machines:
mce: CPU0 BANK15 CMCI inherited storm ------------[ cut here ]------------ ODEBUG: assert_init not available (active state 0) object: (_ptrval_) object type: timer_list hint: 0x0 WARNING: lib/debugobjects.c:632 at debug_object_assert_init+0x178/0x230, CPU#0: swapper/0/0 CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 7.2.0-rc5 #3 PREEMPTLAZY RIP: 0010:debug_object_assert_init+0x18f/0x230 Call Trace: __mod_timer mce_timer_kick cmci_discover intel_init_cmci mce_intel_feature_init mcheck_cpu_init identify_cpu identify_boot_cpu arch_cpu_finalize_init start_kernel
A second splat follows right after, from timer_setup() finding that same timer already queued:
ODEBUG: init active (active state 0) object: (_ptrval_) object type: timer_list hint: stub_timer+0x0/0x10
This is happening because CMCI storm detection is trying to modify the timer before latter was properly set up.
Set up the timer first. __mcheck_cpu_setup_timer() only calls timer_setup(), and depends on neither the generic nor the vendor init.
[ bp: Massage commit message. ]
{
"affected": [],
"aliases": [
"CVE-2026-80727"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-03T13:06:11Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nx86/mce: Set up the polling timer before CMCI discovery\n\nI hit the following on one of my machines:\n\n mce: CPU0 BANK15 CMCI inherited storm\n ------------[ cut here ]------------\n ODEBUG: assert_init not available (active state 0) object: (____ptrval____) object type: timer_list hint: 0x0\n WARNING: lib/debugobjects.c:632 at debug_object_assert_init+0x178/0x230, CPU#0: swapper/0/0\n CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 7.2.0-rc5 #3 PREEMPTLAZY\n RIP: 0010:debug_object_assert_init+0x18f/0x230\n Call Trace:\n \u003cTASK\u003e\n __mod_timer\n mce_timer_kick\n cmci_discover\n intel_init_cmci\n mce_intel_feature_init\n mcheck_cpu_init\n identify_cpu\n identify_boot_cpu\n arch_cpu_finalize_init\n start_kernel\n\nA second splat follows right after, from timer_setup() finding that same\ntimer already queued:\n\n ODEBUG: init active (active state 0) object: (____ptrval____) object type: timer_list hint: stub_timer+0x0/0x10\n\nThis is happening because CMCI storm detection is trying to modify the timer\nbefore latter was properly set up.\n\nSet up the timer first. __mcheck_cpu_setup_timer() only calls timer_setup(),\nand depends on neither the generic nor the vendor init.\n\n [ bp: Massage commit message. ]",
"id": "GHSA-5fmr-wwgg-gfqm",
"modified": "2026-09-03T15:32:14Z",
"published": "2026-09-03T15:32:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80727"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/17ab68d0cf6a41bff61b1e13c6141d9e463736ae"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4f4cba3947d2f0eceb32727e198ca2c149a653a9"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a213dfaa2596c1c0dc4dae91c14fbfa499c03223"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e708fc1566ebd4a2d3f2546e6310d64d362db80d"
}
],
"schema_version": "1.4.0",
"severity": []
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.