CVE-2026-46257 Null dereference in Linux
An attacker with local access can cause a kernel crash on ARM32 platforms by triggering a null pointer dereference in the SP804 timer driver when sched_clock is disabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-46257?
CVE-2026-46257 is a medium-severity vulnerability in Linux kernel, published on 3 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
clocksource/drivers/timer-sp804: Fix an Oops when read_current_timer is called on ARM32 platforms where the SP804 is not registered as the sched_clock.
On SP804, the delay timer shares the same clkevt instance with sched_clock. On some platforms, when sp804_clocksource_and_sched_clock_init is called with use_sched_clock not set to 1, sched_clkevt is not properly initialized. However, sp804_register_delay_timer is invoked unconditionally, and read_current_timer() subsequently calls sp804_read on an uninitialized sched_clkevt, leading to a kernel Oops when accessing sched_clkevt->value.
Declare a dedicated clkevt instance exclusively for delay timer, instead of sharing the same clkevt with sched_clock. This ensures that read_current_timer continues to work correctly regardless of whether SP804 is selected as the sched_clock.
Weakness: CWE-908
Which versions are affected by CVE-2026-46257?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-46257?
Apply the vendor's patch.
Is CVE-2026-46257 being exploited?
There is no known exploitation of CVE-2026-46257 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as GHSA-w9qv-v668-q8rf, UBUNTU-CVE-2026-46257.