CVE-2026-90127— virtio: rtc: time out alarm requests
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Linux 内核中，已解决以下漏洞： virtio: rtc: 为告警（alarm）请求添加超时机制 RTC 类操作在持有 锁的情况下执行。当前，virtio RTC 的告警请求在等待设备返回其请求队列缓冲区时没有设置超时时间。 在设备意外移除时，virtio-pci 会在注销 virtio 设备之前标记 virtqueues 为损坏状态。如果设备停止响应时正有一个告警请求在等待， 在 中尝试获取 时会发生阻塞。由于该请求无法完成，设备移除过程将挂起，直到正在等待的任务收到信号。 解决方案：对告警读取、告警编程
Possible ATT&CK Techniques 1 AI
T1531 · Account Access RemovalAffected Version Matrix 8
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 9d4f22fd563e0cd02e8448e84d057e7c0132a586< 28701b74c22d2a43ddf7aebb6378e60c18323865 |
affected |
9d4f22fd563e0cd02e8448e84d057e7c0132a586< afbf69d1d691c06d093d7c3f17168ecb608c4977 |
affected | ||
9d4f22fd563e0cd02e8448e84d057e7c0132a586< 68e00d9212929805b40dcb9166755610f4f4acee |
affected | ||
6.16 |
affected | ||
< 6.16 |
unaffected | ||
6.18.52≤ 6.18.* |
unaffected | ||
7.2.6≤ 7.2.* |
unaffected | ||
7.3-rc1≤ * |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-90127
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
virtio: rtc: time out alarm requests
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
virtio: rtc: time out alarm requests
RTC class operations run with rtc_device.ops_lock held. The virtio RTC
alarm requests currently wait without a timeout for the device to return
their requestq buffers.
On surprise removal, virtio-pci marks the virtqueues broken before
unregistering the virtio device. If an alarm request is waiting when the
device stops responding, viortc_remove() blocks in viortc_class_stop()
while trying to acquire ops_lock. The request cannot complete and device
removal hangs until the waiting task is signalled.
Use the same 60-second timeout as clock read requests for alarm reads,
alarm programming, and alarm interrupt enable requests. The existing
message reference counting keeps a timed-out request alive until a late
response or device teardown.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-90127
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-90127
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-90127 (2)
Same Patch Batch · Linux · 2026-09-17 · 600 CVEs total
| CVE-2026-90235 | 9.8 CRITICAL | sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE |
| CVE-2026-90104 | 9.8 CRITICAL | NFSv4.1: zero referring call lists before decoding |
| CVE-2026-92489 | 9.8 CRITICAL | xfrm: Fix skb double-free in xfrm_dev_direct_output() |
| CVE-2026-90173 | 9.8 CRITICAL | smb: smbdirect: free completion queues with ib_free_cq() |
| CVE-2026-90151 | 9.8 CRITICAL | NFSv4: remove callback IDR entry on client allocation failure |
| CVE-2026-90110 | 9.4 CRITICAL | inetpeer: randomize RB-tree node comparison using SipHash |
| CVE-2026-90230 | 9.1 CRITICAL | nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate() |
| CVE-2026-90414 | 9.1 CRITICAL | IB/isert: reject PDUs declaring more data than was received |
| CVE-2026-90413 | 9.1 CRITICAL | IB/isert: reject login PDUs declaring more data than was received |
| CVE-2026-93189 | 8.8 HIGH | HID: core: quiesce input in hid_hw_stop() to prevent use-after-free |
| CVE-2026-90256 | 8.8 HIGH | Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind |
| CVE-2026-93042 | 8.8 HIGH | dmaengine: dw-edma: Terminate all descriptors without callbacks |
| CVE-2026-90286 | 8.8 HIGH | drm/amdgpu/gfx6: Use PFP on the compute queues too |
| CVE-2026-90255 | 8.8 HIGH | Bluetooth: hci_conn: fix the SCO setup context lifetime |
| CVE-2026-90425 | 8.8 HIGH | iommu/tegra241-cmdqv: Require exactly one Stream ID for a vSID |
| CVE-2026-90329 | 8.8 HIGH | HID: synchronize input before cleaning up a failed probe |
| CVE-2026-90162 | 8.8 HIGH | ksmbd: defer publishing granted locks to prevent UAF/double-free race |
| CVE-2026-90240 | 8.8 HIGH | iommu/vt-d: Flush context cache with correct SID when tearing down aliases |
| CVE-2026-90367 | 8.8 HIGH | wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER |
| CVE-2026-90371 | 8.8 HIGH | wifi: mt76: fix RXDMAD_C buffer recycling race |
Showing top 20 of 600 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-98385
sched/cache: Decouple sched_cache_group from mm to fix UAF -
CVE-2026-98384
bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destr -
CVE-2026-98383
bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL -
CVE-2026-98382
bpf: Reject dev-bound-only programs on other devices -
CVE-2026-98381
veth: manage XDP program pointers during channel resize
Same vendor: Linux
-
CVE-2026-98385
sched/cache: Decouple sched_cache_group from mm to fix UAF -
CVE-2026-98384
bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destr -
CVE-2026-98383
bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL -
CVE-2026-98382
bpf: Reject dev-bound-only programs on other devices -
CVE-2026-98381
veth: manage XDP program pointers during channel resize
V. Comments for CVE-2026-90127
No comments yet