CVE-2026-68090

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> debugobjects: Plug race against a concurrent OOM disable<br /> <br /> syzbot reported a puzzling splat:<br /> <br /> WARNING: kernel/time/hrtimer.c:443 at stub_timer+0xa/0x20<br /> <br /> stub_timer() is installed as timer callback function in<br /> hrtimer_fixup_assert_init(), which is invoked when<br /> debug_object_assert_init() can&amp;#39;t find a shadow object. In that case debug<br /> objects emits a warning about it before invoking the fixup.<br /> <br /> Though the provided console log lacks this warning and instead has the<br /> following a few seconds before the splat:<br /> <br /> ODEBUG: Out of memory. ODEBUG disabled<br /> <br /> So the object was looked up in debug_object_assert_init() and the lookup<br /> failed due a concurrent out of memory situation which disabled debug<br /> objects and freed the shadow objects:<br /> <br /> debug_object_assert_init()<br /> if (!debug_objects_enabled)<br /> return; obj = alloc();<br /> if (!obj) {<br /> // Out of memory<br /> debug_objects_enabled = false;<br /> free_objects();<br /> obj = lookup_or_alloc();<br /> <br /> // The lookup failed because the other side<br /> // removed the objects, so this returns<br /> // an error code as the object in question<br /> // is not statically initialized<br /> <br /> if (!IS_ERR_OR_NULL(obj))<br /> return;<br /> if (!obj) {<br /> debug_oom();<br /> return;<br /> }<br /> <br /> print(...)<br /> if (!debug_objects_enabled)<br /> return;<br /> <br /> fixup(...)<br /> <br /> The debug object splat is skipped because debug_objects_enabled is false,<br /> but the fixup callback is invoked unconditionally, which makes the timer<br /> disfunctional.<br /> <br /> This is only a problem in debug_object_assert_init() and<br /> debug_object_activate() as both have to handle statically initialized<br /> objects and therefore must handle the error pointer return case<br /> gracefully. All other places only handle the found/not found case and the<br /> NULL pointer return is a signal for OOM. Otherwise they get a valid shadow<br /> object.<br /> <br /> Plug the hole by checking whether debug objects are still enabled before<br /> invoking the print and fixup function in those two places.