CVE-2026-98847: Linux Kernel RTC Race Condition Vulnerability

CVE-2026-98847 Overview

CVE-2026-98847 is a race condition in the Linux kernel's SPEAr real-time clock (RTC) driver. The devm_request_irq() function enables the interrupt before returning, allowing the alarm IRQ handler to execute while the probe() routine is still initializing the device. If the handler fires before the memory-mapped I/O (MMIO) base address and spinlock are set up, the kernel can access uninitialized state. The upstream fix reorders initialization so the MMIO address and spinlock are set up before the alarm IRQ is requested.

Critical Impact
An interrupt arriving during driver probe may dereference an uninitialized MMIO pointer or operate on an uninitialized spinlock, leading to kernel-side undefined behavior on SPEAr RTC-equipped systems.

Affected Products

Linux kernel builds that include the SPEAr RTC driver (drivers/rtc/rtc-spear.c)
Stable kernel branches referenced in the fix commits
Embedded platforms using ST SPEAr SoCs with the in-tree RTC driver

Discovery Timeline

2026-10-18 - CVE-2026-98847 published to the National Vulnerability Database (NVD)
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-98847

Vulnerability Analysis

The SPEAr RTC driver registers its alarm interrupt handler using devm_request_irq() during device probe. This managed helper installs the handler and enables the IRQ line before returning control to the caller. If the IRQ fires immediately, the handler can run before probe finishes populating the device's private structure.

The handler relies on two pieces of state: the MMIO base address used to read and clear alarm status registers, and a spinlock that serializes access to those registers. When these fields are still zero or uninitialized at the moment of first entry, the handler performs reads or writes against an invalid address and locks an uninitialized synchronization primitive. The result is a race condition [CWE-362] with potential kernel memory corruption or a panic on affected hardware.

Root Cause

The root cause is incorrect ordering of initialization steps in the SPEAr RTC probe path. The driver requested the alarm IRQ before storing the MMIO pointer and initializing the spinlock in the driver's private data structure. Because devm_request_irq() enables the interrupt synchronously, any pending or quickly-asserted alarm interrupt reaches the handler before probe completes device setup.

Attack Vector

Triggering the race requires a pending or near-immediate alarm interrupt during module load or device probe on hardware that instantiates the SPEAr RTC. The condition is primarily a reliability and kernel robustness issue on embedded SPEAr platforms rather than a remotely reachable vector. Exploitation surface is limited to local contexts where an attacker influences driver load timing or RTC alarm state.

No verified exploit code is available. See the upstream kernel commits referenced below for the precise code change.

Detection Methods for CVE-2026-98847

Indicators of Compromise

Kernel oops or panic messages referencing rtc-spear or the SPEAr RTC alarm handler during boot
Null pointer dereference backtraces originating in the RTC interrupt path shortly after module load
Unexpected lockdep warnings naming an uninitialized spinlock inside the RTC driver

Detection Strategies

Audit running kernel versions on SPEAr-based devices against the fixed commits listed in the Linux stable tree
Scan build manifests and kernel configurations for CONFIG_RTC_DRV_SPEAR=y or =m to identify exposed images
Review boot logs (dmesg) on affected hardware for RTC-related faults immediately after device probe

Monitoring Recommendations

Centralize kernel log collection from embedded Linux fleets and alert on RTC subsystem crashes
Track kernel version inventory to confirm patched builds propagate to all SPEAr devices
Include RTC alarm handling in post-update smoke tests for firmware and kernel rollouts

How to Mitigate CVE-2026-98847

Immediate Actions Required

Update to a Linux kernel that includes the upstream fix for the SPEAr RTC probe ordering issue
Rebuild and redeploy any custom embedded images that ship an older rtc-spear.c
Prioritize patching on production hardware that enables the SPEAr RTC alarm functionality

Patch Information

The fix initializes the MMIO address and spinlock before calling devm_request_irq() in the SPEAr RTC probe routine. The change is distributed across stable branches in the following commits: 055ef5ce, aeda50d6, c02aa67e, cb6d6a7f, and e0cabda9.

Workarounds

Disable the SPEAr RTC driver by unsetting CONFIG_RTC_DRV_SPEAR where RTC alarm functionality is not required
Avoid loading rtc-spear as a module on affected systems until the patched kernel is deployed
Where feasible, ensure no RTC alarm is pending before driver initialization to reduce the window for the race

bash

# Verify running kernel does not expose the vulnerable driver path
grep CONFIG_RTC_DRV_SPEAR /boot/config-$(uname -r)

# If present and the kernel is unpatched, blacklist the module
echo 'blacklist rtc-spear' | sudo tee /etc/modprobe.d/blacklist-rtc-spear.conf
sudo update-initramfs -u