Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-46257— clocksource/drivers/timer-sp804: Fix an Oops when read_current_timer is called on ARM32 platforms where the SP804 is not registered as the sched_clock.

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于timer-sp804时钟源驱动在未注册为sched_clock时共享同一clkevt实例，导致read_current_timer访问未初始化的sched_clkevt，可能造成内核Oops。

AI Predicted 5.5 Difficulty: Trivial EPSS 0.10% · P1

Affected Version Matrix 6

VendorProduct Version RangeStatus
Linux Linux 640594a04f119338019b0aeed70c7301216595b3< 693b0b594b0f278bafa784984129c0c0f988e352 affected
640594a04f119338019b0aeed70c7301216595b3< 694921a93f3e3621e067afc545cedf6fe3b234a9 affected
6.19 affected
< 6.19 unaffected
6.19.4≤ 6.19.* unaffected
7.0≤ * unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-46257

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
clocksource/drivers/timer-sp804: Fix an Oops when read_current_timer is called on ARM32 platforms where the SP804 is not registered as the sched_clock.
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: clocksource/drivers/timer-sp804: Fix an Oops when read_current_timer is called on ARM32 platforms where the SP804 is not registered as the sched_clock. On SP804, the delay timer shares the same clkevt instance with sched_clock. On some platforms, when sp804_clocksource_and_sched_clock_init is called with use_sched_clock not set to 1, sched_clkevt is not properly initialized. However, sp804_register_delay_timer is invoked unconditionally, and read_current_timer() subsequently calls sp804_read on an uninitialized sched_clkevt, leading to a kernel Oops when accessing sched_clkevt->value. Declare a dedicated clkevt instance exclusively for delay timer, instead of sharing the same clkevt with sched_clock. This ensures that read_current_timer continues to work correctly regardless of whether SP804 is selected as the sched_clock.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于timer-sp804时钟源驱动在未注册为sched_clock时共享同一clkevt实例，导致read_current_timer访问未初始化的sched_clkevt，可能造成内核Oops。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 640594a04f119338019b0aeed70c7301216595b3 ~ 693b0b594b0f278bafa784984129c0c0f988e352 -
Linux Linux 6.19 -

II. Public POCs for CVE-2026-46257

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-46257

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-46257 (2)

Same Patch Batch · Linux · 2026-06-03 · 32 CVEs total

CVE-2026-46244 9.1 CRITICAL netfilter: nft_inner: Fix IPv6 inner_thoff desync
CVE-2026-46266 9.1 CRITICAL inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP
CVE-2026-46264 8.8 HIGH drm/xe/pf: Fix sysfs initialization
CVE-2026-46273 8.6 HIGH ibmveth: Disable GSO for packets with small MSS
CVE-2026-46251 8.4 HIGH btrfs: fix block_group_tree dirty_list corruption
CVE-2026-46270 8.4 HIGH power: supply: rt9455: Fix use-after-free in power_supply_changed()
CVE-2026-46263 7.8 HIGH drm/amd/display: Fix out-of-bounds stream encoder index v3
CVE-2026-46260 7.8 HIGH ipv6: Fix out-of-bound access in fib6_add_rt2node().
CVE-2026-46259 7.8 HIGH procfs: fix missing RCU protection when reading real_parent in do_task_stat()
CVE-2026-46271 7.8 HIGH wifi: ath12k: do WoW offloads only on primary link
CVE-2026-46253 7.8 HIGH pstore/ram: fix buffer overflow in persistent_ram_save_old()
CVE-2026-46265 7.5 HIGH RDMA/hns: Fix WQ_MEM_RECLAIM warning
CVE-2026-46250 7.3 HIGH MIPS: Work around LLVM bug when gp is used as global register variable
CVE-2025-71314 drm/panthor: Recover from panthor_gpu_flush_caches() failures
CVE-2026-46245 drm/amd/display: Fix dc_link NULL handling in HPD init
CVE-2025-71313 PCI: endpoint: Add missing NULL check for alloc_workqueue()
CVE-2026-46246 power: supply: pm8916_lbc: Fix use-after-free for extcon in IRQ handler
CVE-2026-46247 clk: qcom: gfx3d: add parent to parent request map
CVE-2026-46248 wifi: ath12k: clear stale link mapping of ahvif->links_map
CVE-2026-46249 octeontx2-af: Fix PF driver crash with kexec kernel booting

Showing top 20 of 32 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-46257

No comments yet

Leave a comment