CVE-2026-23106 Overview
CVE-2026-23106 is a medium-severity flaw in the Linux kernel's timekeeping subsystem. The __do_adjtimex() function incorrectly references the core timekeeper (tk_core) when called against an auxiliary timekeeper. This results in the wrong timekeeper's leap state being adjusted and triggers a sequence lock write without holding the associated spinlock. The defect was introduced when __do_adjtimex() was generalized to handle any timekeeper. Local, low-privileged callers invoking clock_adjtime() against an auxiliary clock can reach the faulty code path. The issue affects Linux kernel 6.19 release candidates (rc1 through rc6).
Critical Impact
A local user can corrupt kernel timekeeping state and cause kernel warnings or denial of service through clock_adjtime syscalls against auxiliary clocks.
Affected Products
- Linux Kernel 6.19-rc1 through 6.19-rc6
- Linux distributions shipping pre-release 6.19 kernels
- Systems exposing auxiliary timekeepers via clock_adjtime()
Discovery Timeline
- 2026-02-04 - CVE-2026-23106 published to NVD
- 2026-03-19 - Last updated in NVD database
Technical Details for CVE-2026-23106
Vulnerability Analysis
The Linux kernel maintains a core timekeeper (tk_core) and auxiliary timekeepers for additional clock domains. The __do_adjtimex() function was refactored to operate on any timekeeper passed as an argument. However, a stale reference to tk_core remained inside the function. When userspace invokes clock_adjtime() against an auxiliary clock identifier, the code path enters aux_clock_adj() and reaches __do_adjtimex(), but updates the core timekeeper instead of the supplied auxiliary one.
The lock debugging diagnostics catch this because the timekeeper's sequence lock is written without holding the matching spinlock. The resulting WARNING at include/linux/seqlock.h:226 originates from __do_adjtimex+0x394/0x3b0, triggered through __do_sys_clock_adjtime and do_syscall_64. Beyond the warning, the inconsistency can corrupt leap-second state on the wrong clock domain, producing incorrect time readings for processes relying on the affected timekeepers. The vulnerability is classified as [NVD-CWE-noinfo] and represents a kernel logic flaw with availability impact.
Root Cause
During the refactor that generalized __do_adjtimex() for arbitrary timekeepers, the function retained a hardcoded reference to tk_core. The argument-passed timekeeper pointer is ignored for the leap-state adjustment, causing the wrong structure to be modified. The locking discipline assumed by the sequence lock is also violated because the adjustment runs under the auxiliary clock's locking context while writing to the core timekeeper's seqlock.
Attack Vector
Exploitation requires local access with low privileges. An attacker calls the clock_adjtime() syscall targeting an auxiliary clock identifier with an adjtimex request structure. This reaches aux_clock_adj() in kernel/time/timekeeping.c and triggers the incorrect update path. No user interaction is required. The impact is limited to availability — confidentiality and integrity are not directly affected by this defect, though kernel timekeeping integrity is degraded.
No proof-of-concept exploit is publicly available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2026-23106
Indicators of Compromise
- Kernel WARNING messages referencing include/linux/seqlock.h:226 and __do_adjtimex+0x394/0x3b0 in dmesg or system journals
- Stack traces containing aux_clock_adj, __do_sys_clock_adjtime, and do_syscall_64
- Unexpected time drift or leap-state anomalies reported by NTP daemons on auxiliary clock domains
Detection Strategies
- Monitor kernel logs for seqlock lockdep warnings tied to the timekeeping subsystem
- Audit processes invoking clock_adjtime() against auxiliary clock IDs via auditd syscall rules
- Inventory hosts running Linux kernel 6.19 release candidates and flag them for patching
Monitoring Recommendations
- Collect dmesg and /var/log/kern.log centrally and alert on WARNING entries from kernel/time/timekeeping.c
- Track usage of CLOCK_AUX* identifiers in syscall telemetry to baseline legitimate use
- Correlate kernel warnings with the calling UID and process to identify unprivileged callers exercising the path
How to Mitigate CVE-2026-23106
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the stable tree commit e806f7dd and commit 8f7c9dbe
- Avoid deploying Linux kernel 6.19 release candidates in production until the fix is integrated
- Restrict local access on systems running affected pre-release kernels
Patch Information
The fix updates __do_adjtimex() to operate on the correct timekeeper argument instead of referencing tk_core. Distributions tracking the mainline kernel should incorporate the upstream commits. Refer to the Kernel Git commit e806f7dd and Kernel Git commit 8f7c9dbe for the patch contents.
Workarounds
- Roll back to a stable Linux kernel release prior to 6.19-rc1 where auxiliary timekeeper handling is unaffected
- Use seccomp filters or audit policies to restrict clock_adjtime() invocations from untrusted processes
- Disable or avoid use of auxiliary clock domains until the patched kernel is deployed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.