CVE-2026-90127

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

virtio: rtc: time out alarm requests

RTC class operations run with rtc_device.ops_lock held. The virtio RTC

alarm requests currently wait without a timeout for the device to return

their requestq buffers.

On surprise removal, virtio-pci marks the virtqueues broken before

unregistering the virtio device. If an alarm request is waiting when the

device stops responding, viortc_remove() blocks in viortc_class_stop()

while trying to acquire ops_lock. The request cannot complete and device

removal hangs until the waiting task is signalled.

Use the same 60-second timeout as clock read requests for alarm reads,

alarm programming, and alarm interrupt enable requests. The existing

message reference counting keeps a timed-out request alive until a late

response or device teardown.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References