CVE-2026-97925

A MODERATE severity race condition flaw was found in the Linux kernel's timer tick broadcast subsystem. tick_install_broadcast_device() is not serialized against concurrent tick broadcast operations, so when a replacement clock event device is installed while another CPU is performing broadcast handling, the broadcast code can arm a device that has already been shut down and detached. If the original broadcast device has a restricted interrupt affinity mask and the last CPU in that mask is subsequently taken offline, the BUG() in tick_cleanup_dead_cpu() triggers and causes a kernel crash. A local user able to trigger clock event device replacement and CPU hotplug operations could use this race to cause a denial of service; the flaw affects only system availability and does not impact confidentiality or integrity. Red Hat Enterprise Linux 6 is not affected because the vulnerable code is not present in that stream. The fix is deferred for the affected Red Hat Enterprise Linux, Red Hat In-Vehicle OS, and OpenShift Container Platform streams; until a fix is delivered, the residual risk is a local, hard-to-trigger kernel crash (denial of service) on affected systems.