[Bug 2143849] [NEW] Kernel NULL pointer dereference in rb_insert_color via hrtimer/runc nanosleep causes CPU soft lockup

Public bug reported:

Kernel panicked with a NULL pointer dereference triggered by runc
(container runtime) during a nanosleep call, leading to a permanent CPU
6 soft lockup. The system became completely unresponsive (no SSH, no
keyboard input) and required a manual hard reboot to recover.

Ubuntu release: Ubuntu 24.04.4 LTS
Kernel: Ubuntu 6.8.0-101.101-generic 6.8.12
Kernel package version: linux-image-6.8.0-101-generic: 6.8.0-101.101
Hardware: OnLogic Helix52X/K52X
BIOS: Z01-0009I102 08/20/2025

Crash time: Mar 09 2026 20:39:54

Initial fault:
BUG: kernel NULL pointer dereference, address: 0000000000000008
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
Oops: 0000 [#1] PREEMPT SMP NOPTI
CPU: 6 PID: 158306 Comm: runc

Call trace:
rb_insert_color+0x14/0x190
timerqueue_add+0x69/0xd0
enqueue_hrtimer+0x4d/0xc0
hrtimer_start_range_ns+0x187/0x2f0
do_nanosleep+0x51/0x150

Secondary lockup (cascading from above):
native_queued_spin_lock_slowpath+0x83/0x300
__raw_spin_lock_irqsave+0x57/0x80
hrtimer_interrupt+0x51/0x250
__sysvec_apic_timer_interrupt+0x4e/0x120
sysvec_apic_timer_interrupt+0x8d/0xd0

After the initial crash, CPU 6 remained deadlocked on a spin lock
indefinitely. RCU stall warnings were logged every 3 minutes for the
remaining uptime (~15 hours) until manual reboot. The system never self-
recovered.

Reproducer: Unknown. The system runs Docker containers continuously. No
specific container action was observed to trigger it. The crash occurred
without any manual intervention.

ProblemType: Bug
DistroRelease: Ubuntu 24.04
Package: linux-image-6.8.0-101-generic 6.8.0-101.101
ProcVersionSignature: Ubuntu 6.8.0-101.101-generic 6.8.12
Uname: Linux 6.8.0-101-generic x86_64
AlsaVersion: Advanced Linux Sound Architecture Driver Version k6.8.0-101-generic.
AplayDevices: Error: [Errno 2] No such file or directory: 'aplay'
ApportVersion: 2.28.1-0ubuntu3.8
Architecture: amd64
ArecordDevices: Error: [Errno 2] No such file or directory: 'arecord'
AudioDevicesInUse: Error: command ['fuser', '-v', '/dev/snd/by-path', '/dev/snd/controlC0', '/dev/snd/hwC0D2', '/dev/snd/hwC0D0', '/dev/snd/pcmC0D9p', '/dev/snd/pcmC0D8p', '/dev/snd/pcmC0D7p', '/dev/snd/pcmC0D3p', '/dev/snd/pcmC0D0c', '/dev/snd/pcmC0D0p', '/dev/snd/seq', '/dev/snd/timer'] failed with exit code 1:
CRDA: N/A
Card0.Amixer.info: Error: [Errno 2] No such file or directory: 'amixer'
Card0.Amixer.values: Error: [Errno 2] No such file or directory: 'amixer'
CasperMD5CheckResult: pass
CurrentDmesg: Error: command ['dmesg'] failed with exit code 1: dmesg: read kernel buffer failed: Operation not permitted
Date: Tue Mar 10 12:00:02 2026
InstallationDate: Installed on 2025-11-05 (125 days ago)
InstallationMedia: Ubuntu-Server 24.04.3 LTS "Noble Numbat" - Release amd64 (20250805.1)
IwConfig: Error: [Errno 2] No such file or directory: 'iwconfig'
MachineType: OnLogic Helix52X/K52X
ProcEnviron:
LANG=en_US.UTF-8
PATH=(custom, no user)
SHELL=/bin/bash
TERM=linux
XDG_RUNTIME_DIR=<set>
ProcFB: 0 i915drmfb
ProcKernelCmdLine: BOOT_IMAGE=/vmlinuz-6.8.0-101-generic root=/dev/mapper/ubuntu--vg-ubuntu--lv ro
RelatedPackageVersions:
linux-restricted-modules-6.8.0-101-generic N/A
linux-backports-modules-6.8.0-101-generic N/A
linux-firmware 20240318.git3b128b60-0ubuntu2.25
RfKill: Error: [Errno 2] No such file or directory: 'rfkill'
SourcePackage: linux
UpgradeStatus: No upgrade log present (probably fresh install)
acpidump:

dmi.bios.date: 08/20/2025
dmi.bios.release: 0.66
dmi.bios.vendor: INSYDE Corp.
dmi.bios.version: Z01-0009I102
dmi.board.asset.tag: Type2 - Board Asset Tag
dmi.board.name: Helix52X/K52X
dmi.board.vendor: OnLogic
dmi.board.version: Production
dmi.chassis.asset.tag: Chassis Asset Tag
dmi.chassis.type: 10
dmi.chassis.vendor: Chassis Manufacturer
dmi.chassis.version: Chassis Version
dmi.modalias: dmi:bvnINSYDECorp.:bvrZ01-0009I102:bd08/20/2025:br0.66:svnOnLogic:pnHelix52X/K52X:pvrProduction:rvnOnLogic:rnHelix52X/K52X:rvrProduction:cvnChassisManufacturer:ct10:cvrChassisVersion:skuHelix52X_K52X:
dmi.product.family: Helix52X/K52X
dmi.product.name: Helix52X/K52X
dmi.product.sku: Helix52X_K52X
dmi.product.version: Production
dmi.sys.vendor: OnLogic

** Affects: linux (Ubuntu)
Importance: Undecided
Status: New


** Tags: amd64 apport-bug noble

** Attachment added: "lspci-vnvn.log"
https://bugs.launchpad.net/bugs/2143849/+attachment/5951221/+files/lspci-vnvn.log

--
You received this bug notification because you are subscribed to linux
in Ubuntu.
Matching subscriptions: Bgg, Bmail, Nb
https://bugs.launchpad.net/bugs/2143849

Title:
Kernel NULL pointer dereference in rb_insert_color via hrtimer/runc
nanosleep causes CPU soft lockup

Status in linux package in Ubuntu:
New

Bug description:
Kernel panicked with a NULL pointer dereference triggered by runc
(container runtime) during a nanosleep call, leading to a permanent
CPU 6 soft lockup. The system became completely unresponsive (no SSH,
no keyboard input) and required a manual hard reboot to recover.

Ubuntu release: Ubuntu 24.04.4 LTS
Kernel: Ubuntu 6.8.0-101.101-generic 6.8.12
Kernel package version: linux-image-6.8.0-101-generic: 6.8.0-101.101
Hardware: OnLogic Helix52X/K52X
BIOS: Z01-0009I102 08/20/2025

Crash time: Mar 09 2026 20:39:54

Initial fault:
BUG: kernel NULL pointer dereference, address: 0000000000000008
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
Oops: 0000 [#1] PREEMPT SMP NOPTI
CPU: 6 PID: 158306 Comm: runc

Call trace:
rb_insert_color+0x14/0x190
timerqueue_add+0x69/0xd0
enqueue_hrtimer+0x4d/0xc0
hrtimer_start_range_ns+0x187/0x2f0
do_nanosleep+0x51/0x150

Secondary lockup (cascading from above):
native_queued_spin_lock_slowpath+0x83/0x300
__raw_spin_lock_irqsave+0x57/0x80
hrtimer_interrupt+0x51/0x250
__sysvec_apic_timer_interrupt+0x4e/0x120
sysvec_apic_timer_interrupt+0x8d/0xd0

After the initial crash, CPU 6 remained deadlocked on a spin lock
indefinitely. RCU stall warnings were logged every 3 minutes for the
remaining uptime (~15 hours) until manual reboot. The system never
self-recovered.

Reproducer: Unknown. The system runs Docker containers continuously.
No specific container action was observed to trigger it. The crash
occurred without any manual intervention.

ProblemType: Bug
DistroRelease: Ubuntu 24.04
Package: linux-image-6.8.0-101-generic 6.8.0-101.101
ProcVersionSignature: Ubuntu 6.8.0-101.101-generic 6.8.12
Uname: Linux 6.8.0-101-generic x86_64
AlsaVersion: Advanced Linux Sound Architecture Driver Version k6.8.0-101-generic.
AplayDevices: Error: [Errno 2] No such file or directory: 'aplay'
ApportVersion: 2.28.1-0ubuntu3.8
Architecture: amd64
ArecordDevices: Error: [Errno 2] No such file or directory: 'arecord'
AudioDevicesInUse: Error: command ['fuser', '-v', '/dev/snd/by-path', '/dev/snd/controlC0', '/dev/snd/hwC0D2', '/dev/snd/hwC0D0', '/dev/snd/pcmC0D9p', '/dev/snd/pcmC0D8p', '/dev/snd/pcmC0D7p', '/dev/snd/pcmC0D3p', '/dev/snd/pcmC0D0c', '/dev/snd/pcmC0D0p', '/dev/snd/seq', '/dev/snd/timer'] failed with exit code 1:
CRDA: N/A
Card0.Amixer.info: Error: [Errno 2] No such file or directory: 'amixer'
Card0.Amixer.values: Error: [Errno 2] No such file or directory: 'amixer'
CasperMD5CheckResult: pass
CurrentDmesg: Error: command ['dmesg'] failed with exit code 1: dmesg: read kernel buffer failed: Operation not permitted
Date: Tue Mar 10 12:00:02 2026
InstallationDate: Installed on 2025-11-05 (125 days ago)
InstallationMedia: Ubuntu-Server 24.04.3 LTS "Noble Numbat" - Release amd64 (20250805.1)
IwConfig: Error: [Errno 2] No such file or directory: 'iwconfig'
MachineType: OnLogic Helix52X/K52X
ProcEnviron:
LANG=en_US.UTF-8
PATH=(custom, no user)
SHELL=/bin/bash
TERM=linux
XDG_RUNTIME_DIR=<set>
ProcFB: 0 i915drmfb
ProcKernelCmdLine: BOOT_IMAGE=/vmlinuz-6.8.0-101-generic root=/dev/mapper/ubuntu--vg-ubuntu--lv ro
RelatedPackageVersions:
linux-restricted-modules-6.8.0-101-generic N/A
linux-backports-modules-6.8.0-101-generic N/A
linux-firmware 20240318.git3b128b60-0ubuntu2.25
RfKill: Error: [Errno 2] No such file or directory: 'rfkill'
SourcePackage: linux
UpgradeStatus: No upgrade log present (probably fresh install)
acpidump:

dmi.bios.date: 08/20/2025
dmi.bios.release: 0.66
dmi.bios.vendor: INSYDE Corp.
dmi.bios.version: Z01-0009I102
dmi.board.asset.tag: Type2 - Board Asset Tag
dmi.board.name: Helix52X/K52X
dmi.board.vendor: OnLogic
dmi.board.version: Production
dmi.chassis.asset.tag: Chassis Asset Tag
dmi.chassis.type: 10
dmi.chassis.vendor: Chassis Manufacturer
dmi.chassis.version: Chassis Version
dmi.modalias: dmi:bvnINSYDECorp.:bvrZ01-0009I102:bd08/20/2025:br0.66:svnOnLogic:pnHelix52X/K52X:pvrProduction:rvnOnLogic:rnHelix52X/K52X:rvrProduction:cvnChassisManufacturer:ct10:cvrChassisVersion:skuHelix52X_K52X:
dmi.product.family: Helix52X/K52X
dmi.product.name: Helix52X/K52X
dmi.product.sku: Helix52X_K52X
dmi.product.version: Production
dmi.sys.vendor: OnLogic

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2143849/+subscriptions