CVE-2026-53180: Linux Kernel Timer Migration DoS Flaw

CVE-2026-53180 Overview

CVE-2026-53180 is a Linux kernel vulnerability in the timer migration subsystem. The flaw causes a livelock condition in tmigr_handle_remote_up() when handling remote CPU timers. The function tmigr_handle_remote_cpu() skips timer_expire_remote() when the CPU equals smp_processor_id(), incorrectly assuming the local softirq path already processed timers. This assumption fails because jiffies can advance between the local timer wheel processing and the remote handler's expiry evaluation. The result is a timer that is repeatedly reported as expired but never invoked, causing an infinite goto-again loop and CPU exhaustion.

Critical Impact
A kernel livelock can occur in the timer migration path, causing a CPU to spin indefinitely and leading to denial of service through resource exhaustion.

Affected Products

Linux kernel (timer migration subsystem)
Distributions shipping kernels with the timers/migration code path
Stable kernel branches referenced by upstream fix commits

Discovery Timeline

2026-06-25 - CVE-2026-53180 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-53180

Vulnerability Analysis

The vulnerability resides in the Linux kernel's timer migration code, which distributes global timer expiration work across CPUs to reduce wakeups on idle cores. The function tmigr_handle_remote_cpu() contains an optimization that skips calling timer_expire_remote() when the target CPU matches the current smp_processor_id(). This optimization assumes the running CPU has already processed its own global timers through the local softirq path in run_timer_base(BASE_GLOBAL).

The assumption is incorrect because jiffies can advance between the completion of run_timer_base(BASE_GLOBAL) and the evaluation of expiry times in tmigr_handle_remote(). A timer that was not yet expired during local processing can become expired by the time the remote handler examines it. Because the remote path is skipped for the local CPU, the timer is never executed and never removed from the wheel.

Root Cause

The root cause is an unsafe optimization combining a stale liveness assumption with a re-entrant scheduling loop. fetch_next_timer_interrupt_remote() continues to report the stranded timer as expired. The event is re-queued with expires == now on every iteration. The goto-again loop in tmigr_handle_remote_up() then spins without forward progress, producing a livelock [CWE-835] within kernel context.

Attack Vector

The condition is triggered by normal timer scheduling patterns under the timer migration feature and does not require an external network input. A local workload that exercises global timers across CPUs in coordination with idle-state transitions can drive the system into the livelock. The fix removes the conditional skip and calls timer_expire_remote() unconditionally. __run_timer_base() returns immediately when nothing is pending in the local wheel, keeping overhead minimal in the common path. The corrected behavior is implemented in upstream commits including Kernel Git Commit 07b3b83 and Kernel Git Commit d486b49.

Detection Methods for CVE-2026-53180

Indicators of Compromise

A single CPU pinned at 100% in kernel mode (%sys or softirq time) with no observable user workload responsible.
Soft lockup or RCU stall messages in dmesg referencing timer-related call stacks such as tmigr_handle_remote_up or tmigr_handle_remote_cpu.
Scheduler latency spikes and missed timer callbacks on systems using timer migration.

Detection Strategies

Inspect kernel logs for repeated soft lockup warnings tied to the timer migration code path.
Use perf top or bpftrace to identify hot kernel functions, focusing on tmigr_handle_remote_up looping without progress.
Audit running kernel versions against the fix commits to identify hosts still exposed.

Monitoring Recommendations

Alert on sustained per-CPU softirq or system time above expected baselines on Linux fleets.
Forward dmesg and journald kernel logs to centralized logging to capture soft lockup and RCU stall signatures.
Track kernel package versions across hosts to confirm patch deployment status.

How to Mitigate CVE-2026-53180

Immediate Actions Required

Update affected systems to a Linux kernel build that includes the upstream timer migration fix.
Prioritize hosts running latency-sensitive or high-uptime workloads where a stuck CPU has the greatest operational impact.
Validate vendor-supplied kernel updates against the upstream commit hashes listed in the references.

Patch Information

The fix calls timer_expire_remote() unconditionally in tmigr_handle_remote_cpu(), eliminating the unsafe local-CPU skip. Patch references include Kernel Git Commit 07b3b83, Kernel Git Commit 1d6c206, Kernel Git Commit d338e61, and Kernel Git Commit d486b49.

Workarounds

No documented runtime workaround replaces patching; apply the kernel update from your distribution.
Where supported, evaluate disabling the timer migration feature on non-critical systems until patched, accepting the increased idle-CPU wakeup cost.
Enable kernel soft lockup detection (kernel.softlockup_panic or watchdog thresholds) so stuck CPUs are surfaced quickly for operator response.

bash

# Verify the running kernel and confirm fix commits are present
uname -r
rpm -q kernel || dpkg -l | grep linux-image
# Check dmesg for timer migration soft lockups
dmesg | grep -Ei 'soft lockup|tmigr_handle_remote'