{"id":"CVE-2026-98847","kind":"vulnerability","aliases":["CVE-2026-98847"],"related":[],"title":"Linux kernel: SPEAr RTC probe can race its alarm interrupt handler","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nrtc: spear: initialize IRQ state before requesting alarm IRQ\n\ndevm_request_irq() enables the interrupt before it returns, so the handler\nmay run while probe is still initializing the device. Initialize the MMIO\naddress and spinlock before requesting the alarm IRQ.","summary":"In the Linux kernel's SPEAr real-time clock driver, the alarm interrupt was requested before the device's register address and spinlock were set up, so the handler could run during probe while that state was still uninitialized. The sources do not describe an attacker-controlled trigger or a concrete impact beyond this ordering bug.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["arm-spear","embedded","infrastructure","linux-kernel"],"not_affected_if":["no-spear-rtc-hardware"],"how_to_check":"- unknown","fix":"- Update the Linux kernel to a release that includes the upstream fix for rtc: spear, initializing the MMIO address and spinlock before devm_request_irq(); the sources do not name fixed versions.","status":"open","published_at":"2026-10-18T16:17:39+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T05:13:05+00:00","updated_at":"2026-10-25T05:13:05+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:13:05Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream fix for rtc: spear, initializing the MMIO address and spinlock before devm_request_irq(); the sources do not name fixed versions.","reach":"local","title":"Linux kernel: SPEAr RTC probe can race its alarm interrupt handler","impact":"low","summary":"In the Linux kernel's SPEAr real-time clock driver, the alarm interrupt was requested before the device's register address and spinlock were set up, so the handler could run during probe while that state was still uninitialized. The sources do not describe an attacker-controlled trigger or a concrete impact beyond this ordering bug.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","embedded","arm-spear"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown; probe-time race with uninitialized driver state","analyst_note":"","how_to_check":"- unknown","needs_analyst":false,"not_affected_if":["no-spear-rtc-hardware"],"who_is_affected":"Systems running a Linux kernel with the SPEAr RTC driver (rtc-spear) built in or loaded, which is mainly ARM SPEAr-based embedded boards. The sources do not say who can skip it beyond that, and the description gives no evidence of remote reach.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000584,"input_tokens":3328,"output_tokens":502,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98847':14A,17A 'address':47B,127C 'alarm':9A,38B,101C,133C 'arm':19B 'arm-spear':18B 'attack':73B 'attacker-control':72B 'beyond':80B 'bug':83B 'clock':35B 'concret':78B 'control':74B 'could':56B 'cve':12A,15A 'describ':70B 'devic':44B,123C 'devm':103C 'driver':36B 'embed':21B 'enabl':106C 'follow':89C 'handler':11A,55B,114C 'impact':79B 'infrastructur':22B 'initi':96C,121C,124C 'interrupt':10A,39B,108C 'irq':97C,102C,105C,134C 'kernel':2A,25B,29B,87C 'linux':1A,24B,28B,86C 'linux-kernel':23B 'may':115C 'mmio':126C 'order':82B 'probe':5A,59B,118C 'race':7A 'real':33B 'real-tim':32B 'regist':46B 'request':41B,100C,104C,131C 'resolv':93C 'return':111C 'rtc':4A,94C 'run':57B,116C 'set':51B 'sourc':67B 'spear':3A,20B,31B,95C 'spinlock':49B,129C 'state':62B,98C 'still':64B,120C 'time':34B 'trigger':75B 'uniniti':65B 'vulner':90C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the SPEAr RTC driver (rtc-spear) built in or loaded, which is mainly ARM SPEAr-based embedded boards. The sources do not say who can skip it beyond that, and the description gives no evidence of remote reach.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:39+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98847","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98847","severity":null,"published_at":"2026-10-18T16:17:39+00:00","modified_at":"2026-10-21T13:21:49+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}