CVE-2026-53180

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> timers/migration: Fix livelock in tmigr_handle_remote_up()<br /> <br /> tmigr_handle_remote_cpu() skips timer_expire_remote() when cpu ==<br /> smp_processor_id(), assuming the local softirq path already handled this<br /> CPU&amp;#39;s timers.<br /> <br /> This assumption is wrong because jiffies can advance after the handling of<br /> the CPU&amp;#39;s global timers in run_timer_base(BASE_GLOBAL) and before<br /> tmigr_handle_remote() evaluates the expiry times.<br /> <br /> As a consequence a timer which expires after the CPU local timer wheel<br /> advanced and becomes expired in the remote handling is ignored and the<br /> callback is never invoked and removed from the timer wheel.<br /> <br /> What&amp;#39;s worse is that fetch_next_timer_interrupt_remote() keeps reporting it<br /> as expired, and the event is re-queued with expires == now on each<br /> iteration. The goto-again loop spins indefinitely.<br /> <br /> Fix this by calling timer_expire_remote() unconditionally. That&amp;#39;s minimal<br /> overhead for the common case as __run_timer_base() returns immediately if<br /> there is nothing to expire in the local wheel.<br /> <br /> [ tglx: Amend change log and add a comment ]