CVE-2026-43227

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

clocksource/drivers/sh_tmu: Always leave device running after probe

The TMU device can be used as both a clocksource and a clockevent

provider. The driver tries to be smart and power itself on and off, as

well as enabling and disabling its clock when it's not in operation.

This behavior is slightly altered if the TMU is used as an early

platform device in which case the device is left powered on after probe,

but the clock is still enabled and disabled at runtime.

This has worked for a long time, but recent improvements in PREEMPT_RT

and PROVE_LOCKING have highlighted an issue. As the TMU registers itself

as a clockevent provider, clockevents_register_device(), it needs to use

raw spinlocks internally as this is the context of which the clockevent

framework interacts with the TMU driver. However in the context of

holding a raw spinlock the TMU driver can't really manage its power

state or clock with calls to pm_runti

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References