{"cve":"CVE-2026-74749","nvd":{"published":"2026-08-26T15:16:53.933","modified":"2026-08-26T15:16:53.933","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nrseq: Prevent hard lockup on granted time slice extension\n\n__exit_to_user_mode_loop() invokes rseq_grant_timeslice_extension() with\ninterrupts enabled. If the extension is granted it invokes\nhrtimer_rearm_deferred_tif() to ensure that a pending deferred hrtimer\nrearm is handled before exiting to user space.\n\nThough this invokes __hrtimer_rearm_deferred() which expects to be invoked\nwith interrupts disabled as it takes hrtimer_cpu_base::lock with\nraw_spin_lock(). That's a livelock waiting to happen and caught by lockdep:\n\n    WARNING: ./include/linux/hrtimer_rearm.h:17 at irqentry_exit, CPU#1: slice_test\n    WARNING: inconsistent lock state\n    inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage.\n\nPrevent this by disabling interrupts around the invocation of\nhrtimer_rearm_deferred_tif() in rseq_grant_timeslice_extension().\n\n[ tglx: Massaged change log ]","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/8bbf4405050bc4f98be68082a20efa081ea8ad9b","https://git.kernel.org/stable/c/ada54c2ba652348c590d1ace6a2f4ff77cbbf809"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:50:17.453294893+00:00"},"epss":{"cve":"CVE-2026-74749","score":0.00198,"percentile":0.09559,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}