GHSA-H4VF-F6XJ-7CCF
Vulnerability from github – Published: 2026-09-17 18:31 – Updated: 2026-09-17 18:31In the Linux kernel, the following vulnerability has been resolved:
virtio: rtc: time out alarm requests
RTC class operations run with rtc_device.ops_lock held. The virtio RTC alarm requests currently wait without a timeout for the device to return their requestq buffers.
On surprise removal, virtio-pci marks the virtqueues broken before unregistering the virtio device. If an alarm request is waiting when the device stops responding, viortc_remove() blocks in viortc_class_stop() while trying to acquire ops_lock. The request cannot complete and device removal hangs until the waiting task is signalled.
Use the same 60-second timeout as clock read requests for alarm reads, alarm programming, and alarm interrupt enable requests. The existing message reference counting keeps a timed-out request alive until a late response or device teardown.
{
"affected": [],
"aliases": [
"CVE-2026-90127"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-17T17:17:05Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio: rtc: time out alarm requests\n\nRTC class operations run with rtc_device.ops_lock held. The virtio RTC\nalarm requests currently wait without a timeout for the device to return\ntheir requestq buffers.\n\nOn surprise removal, virtio-pci marks the virtqueues broken before\nunregistering the virtio device. If an alarm request is waiting when the\ndevice stops responding, viortc_remove() blocks in viortc_class_stop()\nwhile trying to acquire ops_lock. The request cannot complete and device\nremoval hangs until the waiting task is signalled.\n\nUse the same 60-second timeout as clock read requests for alarm reads,\nalarm programming, and alarm interrupt enable requests. The existing\nmessage reference counting keeps a timed-out request alive until a late\nresponse or device teardown.",
"id": "GHSA-h4vf-f6xj-7ccf",
"modified": "2026-09-17T18:31:51Z",
"published": "2026-09-17T18:31:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90127"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/28701b74c22d2a43ddf7aebb6378e60c18323865"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/68e00d9212929805b40dcb9166755610f4f4acee"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/afbf69d1d691c06d093d7c3f17168ecb608c4977"
}
],
"schema_version": "1.4.0",
"severity": []
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.