CVE-2026-23106 timekeeping: Adjust the leap state for the correct auxiliary timekeeper
A race condition in the Linux kernel timekeeping subsystem can cause a kernel warning and potential instability when adjusting time on auxiliary timekeepers.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23106?
CVE-2026-23106 is a medium-severity vulnerability in Linux kernel, published on 4 Feb 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
timekeeping: Adjust the leap state for the correct auxiliary timekeeper
When __do_ajdtimex() was introduced to handle adjtimex for any timekeeper, this reference to tk_core was not updated. When called on an auxiliary timekeeper, the core timekeeper would be updated incorrectly.
This gets caught by the lock debugging diagnostics because the timekeepers sequence lock gets written to without holding its associated spinlock:
WARNING: include/linux/seqlock.h:226 at __do_adjtimex+0x394/0x3b0, CPU#2: test/125 aux_clock_adj (kernel/time/timekeeping.c:2979) __do_sys_clock_adjtime (kernel/time/posix-timers.c:1161 kernel/time/posix-timers.c:1173) do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1)) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:131)
Update the correct auxiliary timekeeper.
Which versions are affected by CVE-2026-23106?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-23106?
Apply the vendor's patch.
Is CVE-2026-23106 being exploited?
There is no known exploitation of CVE-2026-23106 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-23106, DEBIAN-CVE-2026-23106, GHSA-gx3f-mw8m-6ff3, UBUNTU-CVE-2026-23106.