CVE-2026-23106

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23106", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:45.966Z", "datePublished": "2026-02-04T16:08:27.046Z", "dateUpdated": "2026-05-11T22:00:14.456Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:00:14.456Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntimekeeping: Adjust the leap state for the correct auxiliary timekeeper\n\nWhen __do_ajdtimex() was introduced to handle adjtimex for any\ntimekeeper, this reference to tk_core was not updated. When called on an\nauxiliary timekeeper, the core timekeeper would be updated incorrectly.\n\nThis gets caught by the lock debugging diagnostics because the\ntimekeepers sequence lock gets written to without holding its\nassociated spinlock:\n\nWARNING: include/linux/seqlock.h:226 at __do_adjtimex+0x394/0x3b0, CPU#2: test/125\naux_clock_adj (kernel/time/timekeeping.c:2979)\n__do_sys_clock_adjtime (kernel/time/posix-timers.c:1161 kernel/time/posix-timers.c:1173)\ndo_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1))\nentry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:131)\n\nUpdate the correct auxiliary timekeeper."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/time/timekeeping.c"], "versions": [{"version": "775f71ebedd382da390dc16a4c28cffa5b937f79", "lessThan": "8f7c9dbeaa0be5810e44d323735967d3dba9239d", "status": "affected", "versionType": "git"}, {"version": "775f71ebedd382da390dc16a4c28cffa5b937f79", "lessThan": "e806f7dde8ba28bc72a7a0898589cac79f6362ac", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/time/timekeeping.c"], "versions": [{"version": "6.17", "status": "affected"}, {"version": "0", "lessThan": "6.17", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.8", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "6.18.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "6.19"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/8f7c9dbeaa0be5810e44d323735967d3dba9239d"}, {"url": "https://git.kernel.org/stable/c/e806f7dde8ba28bc72a7a0898589cac79f6362ac"}], "title": "timekeeping: Adjust the leap state for the correct auxiliary timekeeper", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/time/timekeeping.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "8f7c9dbeaa0be5810e44d323735967d3dba9239d", "status": "affected", "version": "775f71ebedd382da390dc16a4c28cffa5b937f79", "versionType": "git"}, {"lessThan": "e806f7dde8ba28bc72a7a0898589cac79f6362ac", "status": "affected", "version": "775f71ebedd382da390dc16a4c28cffa5b937f79", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/time/timekeeping.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.17"}, {"lessThan": "6.17", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.19", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B85D4F7E-5EBC-46E3-BF55-682F134FC24E", "versionEndExcluding": "6.18.8", "versionStartIncluding": "6.17", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*", "matchCriteriaId": "17B67AA7-40D6-4AFA-8459-F200F3D7CFD1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*", "matchCriteriaId": "C47E4CC9-C826-4FA9-B014-7FE3D9B318B2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*", "matchCriteriaId": "F71D92C0-C023-48BD-B3B6-70B638EEE298", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*", "matchCriteriaId": "13580667-0A98-40CC-B29F-D12790B91BDB", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*", "matchCriteriaId": "CAD1FED7-CF48-47BF-AC7D-7B6FA3C065FC", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*", "matchCriteriaId": "3EF854A1-ABB1-4E93-BE9A-44569EC76C0D", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntimekeeping: Adjust the leap state for the correct auxiliary timekeeper\n\nWhen __do_ajdtimex() was introduced to handle adjtimex for any\ntimekeeper, this reference to tk_core was not updated. When called on an\nauxiliary timekeeper, the core timekeeper would be updated incorrectly.\n\nThis gets caught by the lock debugging diagnostics because the\ntimekeepers sequence lock gets written to without holding its\nassociated spinlock:\n\nWARNING: include/linux/seqlock.h:226 at __do_adjtimex+0x394/0x3b0, CPU#2: test/125\naux_clock_adj (kernel/time/timekeeping.c:2979)\n__do_sys_clock_adjtime (kernel/time/posix-timers.c:1161 kernel/time/posix-timers.c:1173)\ndo_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1))\nentry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:131)\n\nUpdate the correct auxiliary timekeeper."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ngesti\u00f3n del tiempo: Ajustar el estado de salto para el gestor de tiempo auxiliar correcto\n\nCuando se introdujo __do_ajdtimex() para manejar adjtimex para cualquier gestor de tiempo, esta referencia a tk_core no fue actualizada. Cuando se invocaba en un gestor de tiempo auxiliar, el gestor de tiempo principal se actualizar\u00eda incorrectamente.\n\nEsto es detectado por los diagn\u00f3sticos de depuraci\u00f3n de bloqueos porque el bloqueo de secuencia de los gestores de tiempo se escribe sin mantener su spinlock asociado:\n\nADVERTENCIA: include/linux/seqlock.h:226 at __do_adjtimex+0x394/0x3b0, CPU#2: test/125\naux_clock_adj (kernel/time/timekeeping.c:2979)\n__do_sys_clock_adjtime (kernel/time/posix-timers.c:1161 kernel/time/posix-timers.c:1173)\ndo_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1))\nentry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:131)\n\nActualizar el gestor de tiempo auxiliar correcto."}], "id": "CVE-2026-23106", "lastModified": "2026-06-17T10:20:54.243", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-02-04T17:16:21.470", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8f7c9dbeaa0be5810e44d323735967d3dba9239d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e806f7dde8ba28bc72a7a0898589cac79f6362ac"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: timekeeping: Adjust the leap state for the correct auxiliary timekeeper", "id": "2436784", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436784"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2026-23106", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-02-04T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23106\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23106\nhttps://lore.kernel.org/linux-cve-announce/2026020430-CVE-2026-23106-3edb@gregkh/T"], "threat_severity": "Low"}

{"analysis": {"en": {"generated_at": "2026-04-18T21:06:02.308719+00:00", "value": {"mitigation_remediation": ["Upgrade the system to a Linux kernel version that includes the commit fixing the auxiliary timekeeper handling; at least the final 6.19 kernel or a later stable release.", "If an immediate update is not possible, rebuild the kernel with the specific commit that corrects the sequence lock update for auxiliary timekeepers.", "Limit or disable usage of adjtimex on auxiliary timekeepers by restricting the system call to trusted privileged contexts or by applying policy controls."], "summary": {"action": "Apply Kernel Patch", "impact": "Timekeeping Corruption"}, "threat_synthesis": {"affected_systems": "All Linux kernel builds that include the 6.19 series up to at least release candidate 6.19\u2011rc6 are vulnerable. This includes any distribution or custom kernel derived from that line, regardless of the distribution, because the flaw resides in the core kernel timekeeping source.", "description_and_impact": "In the Linux kernel, the function __do_ajdtimex, introduced to enable adjtimex on any timekeeper, mistakenly references the core timekeeper (tk_core) when operating on an auxiliary timekeeper. This causes the core timekeeper\u2019s sequence lock to be written to without holding its spinlock, triggering lock\u2011debug diagnostics and leading to an inconsistent leap\u2011second state across the kernel\u2019s timekeeping subsystem.", "risk_and_exploitability": "The CVSS score is 5.5, indicating moderate severity. The EPSS score is less than 1\u202f%, showing a very low likelihood of exploitation. It is not listed in CISA\u2019s KEV catalog. The vulnerability is triggered by the adjtimex system call when an auxiliary timekeeper is targeted; the call requires elevated privileges, likely root, but the precise privilege level is not explicitly stated. Applying the available patch mitigates the issue completely."}}}}, "created": "2026-04-18T21:15:10.421184+00:00", "updated": "2026-04-18T21:15:10.421197+00:00", "vendors": [], "weaknesses": ["CWE-362", "CWE-164"]}