GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-43227 (GCVE-0-2026-43227)

Vulnerability from cvelistv5 – Published: 2026-05-06 11:28 – Updated: 2026-05-11 22:20
VLAI
Title
clocksource/drivers/sh_tmu: Always leave device running after probe
Summary
In the Linux kernel, the following vulnerability has been resolved: clocksource/drivers/sh_tmu: Always leave device running after probe The TMU device can be used as both a clocksource and a clockevent provider. The driver tries to be smart and power itself on and off, as well as enabling and disabling its clock when it's not in operation. This behavior is slightly altered if the TMU is used as an early platform device in which case the device is left powered on after probe, but the clock is still enabled and disabled at runtime. This has worked for a long time, but recent improvements in PREEMPT_RT and PROVE_LOCKING have highlighted an issue. As the TMU registers itself as a clockevent provider, clockevents_register_device(), it needs to use raw spinlocks internally as this is the context of which the clockevent framework interacts with the TMU driver. However in the context of holding a raw spinlock the TMU driver can't really manage its power state or clock with calls to pm_runtime_*() and clk_*() as these calls end up in other platform drivers using regular spinlocks to control power and clocks. This mix of spinlock contexts trips a lockdep warning. ============================= [ BUG: Invalid wait context ] 6.18.0-arm64-renesas-09926-gee959e7c5e34 #1 Not tainted ----------------------------- swapper/0/0 is trying to lock: ffff000008c9e180 (&dev->power.lock){-...}-{3:3}, at: __pm_runtime_resume+0x38/0x88 other info that might help us debug this: context-{5:5} 1 lock held by swapper/0/0: ccree e6601000.crypto: ARM CryptoCell 630P Driver: HW version 0xAF400001/0xDCC63000, Driver version 5.0 #0: ffff8000817ec298 ccree e6601000.crypto: ARM ccree device initialized (tick_broadcast_lock){-...}-{2:2}, at: __tick_broadcast_oneshot_control+0xa4/0x3a8 stack backtrace: CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.18.0-arm64-renesas-09926-gee959e7c5e34 #1 PREEMPT Hardware name: Renesas Salvator-X 2nd version board based on r8a77965 (DT) Call trace: show_stack+0x14/0x1c (C) dump_stack_lvl+0x6c/0x90 dump_stack+0x14/0x1c __lock_acquire+0x904/0x1584 lock_acquire+0x220/0x34c _raw_spin_lock_irqsave+0x58/0x80 __pm_runtime_resume+0x38/0x88 sh_tmu_clock_event_set_oneshot+0x84/0xd4 clockevents_switch_state+0xfc/0x13c tick_broadcast_set_event+0x30/0xa4 __tick_broadcast_oneshot_control+0x1e0/0x3a8 tick_broadcast_oneshot_control+0x30/0x40 cpuidle_enter_state+0x40c/0x680 cpuidle_enter+0x30/0x40 do_idle+0x1f4/0x280 cpu_startup_entry+0x34/0x40 kernel_init+0x0/0x130 do_one_initcall+0x0/0x230 __primary_switched+0x88/0x90 For non-PREEMPT_RT builds this is not really an issue, but for PREEMPT_RT builds where normal spinlocks can sleep this might be an issue. Be cautious and always leave the power and clock running after probe.
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 9570ef20423b549757aa484ad388f9a7d5bdc4d9 , < 79d650695773f03de36b99228a090d33d1c18264 (git)
Affected: 9570ef20423b549757aa484ad388f9a7d5bdc4d9 , < f0b31247e7d67a943b3a09d3cef7c0ae788d88e6 (git)
Affected: 9570ef20423b549757aa484ad388f9a7d5bdc4d9 , < 016476afef993d1201a19decc9b5b2ea1e6620f2 (git)
Affected: 9570ef20423b549757aa484ad388f9a7d5bdc4d9 , < 6f113ab549b864c1bc57d4f89846ee335394089a (git)
Affected: 9570ef20423b549757aa484ad388f9a7d5bdc4d9 , < 88c76792180dffd83f1c5b9dc8fdaeb145cb94e0 (git)
Affected: 9570ef20423b549757aa484ad388f9a7d5bdc4d9 , < bc59d5f3afe41fec5d673c27c703b761ae578d28 (git)
Affected: 9570ef20423b549757aa484ad388f9a7d5bdc4d9 , < 0e513cc6b9cea190fe342cc222b1054e7e8acfc8 (git)
Affected: 9570ef20423b549757aa484ad388f9a7d5bdc4d9 , < b1278972b08e480990e2789bdc6a7c918bc349be (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.31
Unaffected: 0 , < 2.6.31 (semver)
Unaffected: 5.10.252 , ≤ 5.10.* (semver)
Unaffected: 5.15.202 , ≤ 5.15.* (semver)
Unaffected: 6.1.165 , ≤ 6.1.* (semver)
Unaffected: 6.6.128 , ≤ 6.6.* (semver)
Unaffected: 6.12.75 , ≤ 6.12.* (semver)
Unaffected: 6.18.16 , ≤ 6.18.* (semver)
Unaffected: 6.19.6 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/clocksource/sh_tmu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "79d650695773f03de36b99228a090d33d1c18264",
              "status": "affected",
              "version": "9570ef20423b549757aa484ad388f9a7d5bdc4d9",
              "versionType": "git"
            },
            {
              "lessThan": "f0b31247e7d67a943b3a09d3cef7c0ae788d88e6",
              "status": "affected",
              "version": "9570ef20423b549757aa484ad388f9a7d5bdc4d9",
              "versionType": "git"
            },
            {
              "lessThan": "016476afef993d1201a19decc9b5b2ea1e6620f2",
              "status": "affected",
              "version": "9570ef20423b549757aa484ad388f9a7d5bdc4d9",
              "versionType": "git"
            },
            {
              "lessThan": "6f113ab549b864c1bc57d4f89846ee335394089a",
              "status": "affected",
              "version": "9570ef20423b549757aa484ad388f9a7d5bdc4d9",
              "versionType": "git"
            },
            {
              "lessThan": "88c76792180dffd83f1c5b9dc8fdaeb145cb94e0",
              "status": "affected",
              "version": "9570ef20423b549757aa484ad388f9a7d5bdc4d9",
              "versionType": "git"
            },
            {
              "lessThan": "bc59d5f3afe41fec5d673c27c703b761ae578d28",
              "status": "affected",
              "version": "9570ef20423b549757aa484ad388f9a7d5bdc4d9",
              "versionType": "git"
            },
            {
              "lessThan": "0e513cc6b9cea190fe342cc222b1054e7e8acfc8",
              "status": "affected",
              "version": "9570ef20423b549757aa484ad388f9a7d5bdc4d9",
              "versionType": "git"
            },
            {
              "lessThan": "b1278972b08e480990e2789bdc6a7c918bc349be",
              "status": "affected",
              "version": "9570ef20423b549757aa484ad388f9a7d5bdc4d9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/clocksource/sh_tmu.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.31"
            },
            {
              "lessThan": "2.6.31",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.252",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.202",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.252",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.202",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.165",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.128",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.16",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclocksource/drivers/sh_tmu: Always leave device running after probe\n\nThe TMU device can be used as both a clocksource and a clockevent\nprovider. The driver tries to be smart and power itself on and off, as\nwell as enabling and disabling its clock when it\u0027s not in operation.\nThis behavior is slightly altered if the TMU is used as an early\nplatform device in which case the device is left powered on after probe,\nbut the clock is still enabled and disabled at runtime.\n\nThis has worked for a long time, but recent improvements in PREEMPT_RT\nand PROVE_LOCKING have highlighted an issue. As the TMU registers itself\nas a clockevent provider, clockevents_register_device(), it needs to use\nraw spinlocks internally as this is the context of which the clockevent\nframework interacts with the TMU driver. However in the context of\nholding a raw spinlock the TMU driver can\u0027t really manage its power\nstate or clock with calls to pm_runtime_*() and clk_*() as these calls\nend up in other platform drivers using regular spinlocks to control\npower and clocks.\n\nThis mix of spinlock contexts trips a lockdep warning.\n\n    =============================\n    [ BUG: Invalid wait context ]\n    6.18.0-arm64-renesas-09926-gee959e7c5e34 #1 Not tainted\n    -----------------------------\n    swapper/0/0 is trying to lock:\n    ffff000008c9e180 (\u0026dev-\u003epower.lock){-...}-{3:3}, at: __pm_runtime_resume+0x38/0x88\n    other info that might help us debug this:\n    context-{5:5}\n    1 lock held by swapper/0/0:\n    ccree e6601000.crypto: ARM CryptoCell 630P Driver: HW version 0xAF400001/0xDCC63000, Driver version 5.0\n     #0: ffff8000817ec298\n    ccree e6601000.crypto: ARM ccree device initialized\n     (tick_broadcast_lock){-...}-{2:2}, at: __tick_broadcast_oneshot_control+0xa4/0x3a8\n    stack backtrace:\n    CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.18.0-arm64-renesas-09926-gee959e7c5e34 #1 PREEMPT\n    Hardware name: Renesas Salvator-X 2nd version board based on r8a77965 (DT)\n    Call trace:\n     show_stack+0x14/0x1c (C)\n     dump_stack_lvl+0x6c/0x90\n     dump_stack+0x14/0x1c\n     __lock_acquire+0x904/0x1584\n     lock_acquire+0x220/0x34c\n     _raw_spin_lock_irqsave+0x58/0x80\n     __pm_runtime_resume+0x38/0x88\n     sh_tmu_clock_event_set_oneshot+0x84/0xd4\n     clockevents_switch_state+0xfc/0x13c\n     tick_broadcast_set_event+0x30/0xa4\n     __tick_broadcast_oneshot_control+0x1e0/0x3a8\n     tick_broadcast_oneshot_control+0x30/0x40\n     cpuidle_enter_state+0x40c/0x680\n     cpuidle_enter+0x30/0x40\n     do_idle+0x1f4/0x280\n     cpu_startup_entry+0x34/0x40\n     kernel_init+0x0/0x130\n     do_one_initcall+0x0/0x230\n     __primary_switched+0x88/0x90\n\nFor non-PREEMPT_RT builds this is not really an issue, but for\nPREEMPT_RT builds where normal spinlocks can sleep this might be an\nissue. Be cautious and always leave the power and clock running after\nprobe."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T22:20:27.826Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/79d650695773f03de36b99228a090d33d1c18264"
        },
        {
          "url": "https://git.kernel.org/stable/c/f0b31247e7d67a943b3a09d3cef7c0ae788d88e6"
        },
        {
          "url": "https://git.kernel.org/stable/c/016476afef993d1201a19decc9b5b2ea1e6620f2"
        },
        {
          "url": "https://git.kernel.org/stable/c/6f113ab549b864c1bc57d4f89846ee335394089a"
        },
        {
          "url": "https://git.kernel.org/stable/c/88c76792180dffd83f1c5b9dc8fdaeb145cb94e0"
        },
        {
          "url": "https://git.kernel.org/stable/c/bc59d5f3afe41fec5d673c27c703b761ae578d28"
        },
        {
          "url": "https://git.kernel.org/stable/c/0e513cc6b9cea190fe342cc222b1054e7e8acfc8"
        },
        {
          "url": "https://git.kernel.org/stable/c/b1278972b08e480990e2789bdc6a7c918bc349be"
        }
      ],
      "title": "clocksource/drivers/sh_tmu: Always leave device running after probe",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43227",
    "datePublished": "2026-05-06T11:28:25.629Z",
    "dateReserved": "2026-05-01T14:12:55.994Z",
    "dateUpdated": "2026-05-11T22:20:27.826Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-43227",
      "date": "2026-09-03",
      "epss": "0.00123",
      "percentile": "0.02308"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-43227\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-06T12:16:42.537\",\"lastModified\":\"2026-06-17T10:49:11.570\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nclocksource/drivers/sh_tmu: Always leave device running after probe\\n\\nThe TMU device can be used as both a clocksource and a clockevent\\nprovider. The driver tries to be smart and power itself on and off, as\\nwell as enabling and disabling its clock when it\u0027s not in operation.\\nThis behavior is slightly altered if the TMU is used as an early\\nplatform device in which case the device is left powered on after probe,\\nbut the clock is still enabled and disabled at runtime.\\n\\nThis has worked for a long time, but recent improvements in PREEMPT_RT\\nand PROVE_LOCKING have highlighted an issue. As the TMU registers itself\\nas a clockevent provider, clockevents_register_device(), it needs to use\\nraw spinlocks internally as this is the context of which the clockevent\\nframework interacts with the TMU driver. However in the context of\\nholding a raw spinlock the TMU driver can\u0027t really manage its power\\nstate or clock with calls to pm_runtime_*() and clk_*() as these calls\\nend up in other platform drivers using regular spinlocks to control\\npower and clocks.\\n\\nThis mix of spinlock contexts trips a lockdep warning.\\n\\n    =============================\\n    [ BUG: Invalid wait context ]\\n    6.18.0-arm64-renesas-09926-gee959e7c5e34 #1 Not tainted\\n    -----------------------------\\n    swapper/0/0 is trying to lock:\\n    ffff000008c9e180 (\u0026dev-\u003epower.lock){-...}-{3:3}, at: __pm_runtime_resume+0x38/0x88\\n    other info that might help us debug this:\\n    context-{5:5}\\n    1 lock held by swapper/0/0:\\n    ccree e6601000.crypto: ARM CryptoCell 630P Driver: HW version 0xAF400001/0xDCC63000, Driver version 5.0\\n     #0: ffff8000817ec298\\n    ccree e6601000.crypto: ARM ccree device initialized\\n     (tick_broadcast_lock){-...}-{2:2}, at: __tick_broadcast_oneshot_control+0xa4/0x3a8\\n    stack backtrace:\\n    CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.18.0-arm64-renesas-09926-gee959e7c5e34 #1 PREEMPT\\n    Hardware name: Renesas Salvator-X 2nd version board based on r8a77965 (DT)\\n    Call trace:\\n     show_stack+0x14/0x1c (C)\\n     dump_stack_lvl+0x6c/0x90\\n     dump_stack+0x14/0x1c\\n     __lock_acquire+0x904/0x1584\\n     lock_acquire+0x220/0x34c\\n     _raw_spin_lock_irqsave+0x58/0x80\\n     __pm_runtime_resume+0x38/0x88\\n     sh_tmu_clock_event_set_oneshot+0x84/0xd4\\n     clockevents_switch_state+0xfc/0x13c\\n     tick_broadcast_set_event+0x30/0xa4\\n     __tick_broadcast_oneshot_control+0x1e0/0x3a8\\n     tick_broadcast_oneshot_control+0x30/0x40\\n     cpuidle_enter_state+0x40c/0x680\\n     cpuidle_enter+0x30/0x40\\n     do_idle+0x1f4/0x280\\n     cpu_startup_entry+0x34/0x40\\n     kernel_init+0x0/0x130\\n     do_one_initcall+0x0/0x230\\n     __primary_switched+0x88/0x90\\n\\nFor non-PREEMPT_RT builds this is not really an issue, but for\\nPREEMPT_RT builds where normal spinlocks can sleep this might be an\\nissue. Be cautious and always leave the power and clock running after\\nprobe.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/clocksource/sh_tmu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"9570ef20423b549757aa484ad388f9a7d5bdc4d9\",\"lessThan\":\"79d650695773f03de36b99228a090d33d1c18264\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9570ef20423b549757aa484ad388f9a7d5bdc4d9\",\"lessThan\":\"f0b31247e7d67a943b3a09d3cef7c0ae788d88e6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9570ef20423b549757aa484ad388f9a7d5bdc4d9\",\"lessThan\":\"016476afef993d1201a19decc9b5b2ea1e6620f2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9570ef20423b549757aa484ad388f9a7d5bdc4d9\",\"lessThan\":\"6f113ab549b864c1bc57d4f89846ee335394089a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9570ef20423b549757aa484ad388f9a7d5bdc4d9\",\"lessThan\":\"88c76792180dffd83f1c5b9dc8fdaeb145cb94e0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9570ef20423b549757aa484ad388f9a7d5bdc4d9\",\"lessThan\":\"bc59d5f3afe41fec5d673c27c703b761ae578d28\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9570ef20423b549757aa484ad388f9a7d5bdc4d9\",\"lessThan\":\"0e513cc6b9cea190fe342cc222b1054e7e8acfc8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9570ef20423b549757aa484ad388f9a7d5bdc4d9\",\"lessThan\":\"b1278972b08e480990e2789bdc6a7c918bc349be\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/clocksource/sh_tmu.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.31\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.31\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.252\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.202\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.165\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.128\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.75\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.16\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.6\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.6.31\",\"versionEndExcluding\":\"5.10.252\",\"matchCriteriaId\":\"790A3A0E-E329-48DE-816C-2EDD7B22E08B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.202\",\"matchCriteriaId\":\"4002FC2B-1456-4666-B240-0EBF590C4671\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.165\",\"matchCriteriaId\":\"797C7F46-D0BE-4FB8-A502-C5EF8E6B6654\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.128\",\"matchCriteriaId\":\"851E9353-6C09-4CC9-877E-E09DB164A3C2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.75\",\"matchCriteriaId\":\"BCE16369-98ED-41CF-8995-DFDC10B288D2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.16\",\"matchCriteriaId\":\"B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.6\",\"matchCriteriaId\":\"373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/016476afef993d1201a19decc9b5b2ea1e6620f2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/0e513cc6b9cea190fe342cc222b1054e7e8acfc8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6f113ab549b864c1bc57d4f89846ee335394089a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/79d650695773f03de36b99228a090d33d1c18264\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/88c76792180dffd83f1c5b9dc8fdaeb145cb94e0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b1278972b08e480990e2789bdc6a7c918bc349be\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/bc59d5f3afe41fec5d673c27c703b761ae578d28\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f0b31247e7d67a943b3a09d3cef7c0ae788d88e6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-06-28T11:19:50+00:00",
      "cve": "CVE-2026-43227",
      "id": "CVE-2026-43227",
      "initial_release_date": "2026-05-06T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: clocksource/drivers/sh_tmu: Always leave device running after probe",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43227.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-05T00:38:53Z",
      "cve": "CVE-2026-43227",
      "id": "CVE-2026-43227",
      "initial_release_date": "2026-05-09T02:40:37Z",
      "product_status:known_affected": "295",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-43227",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-43227.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.