CVE-2026-23106
kernel: timekeeping: Adjust the leap state for the correct auxiliary timekeeper
Severity
LowRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · February 4, 2026
Updated · June 28, 2026
Description
A locking violation was found in the Linux kernel's timekeeping subsystem. The __do_adjtimex() function incorrectly references tk_core instead of the passed auxiliary timekeeper when adjusting leap second state. This causes the core timekeeper's sequence lock to be written without holding its associated spinlock, violating the seqlock protocol and triggering lock debugging warnings.
Statement
This bug manifests as a kernel warning when clock_adjtime() is called on auxiliary timekeepers. While the immediate symptom is a lock debugging diagnostic warning, the incorrect update of the core timekeeper instead of the auxiliary one could cause time synchronization issues. The impact is primarily a warning message and potential time accuracy problems rather than a crash.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 3.3CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CWE-820 · Missing Synchronization