Skip to main content

Linux Kernel CVE-2026-64370

| EUVDEUVD-2026-48914 MEDIUM
2026-07-25 Linux GHSA-cp5v-2q38-79vc
Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local unprivileged trigger via POSIX timer syscall; pid reference exhaustion causes availability loss only, with no confidentiality or integrity impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
4.7 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

6
Metadata Corrected
Sep 08, 2026 - 18:40 vuln.today
tag: Information Disclosure removed
Analysis Generated
Sep 08, 2026 - 17:46 vuln.today
CVSS changed
Sep 08, 2026 - 15:37 NVD
5.5 (MEDIUM)
Patch available
Jul 25, 2026 - 11:18 EUVD
CVE Published
Jul 25, 2026 - 08:50 nvd
MEDIUM 5.5
CVE Published
Jul 25, 2026 - 08:50 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path

In do_cpu_nanosleep(), posix_cpu_timer_create() takes a pid reference via get_pid() and stores it in timer.it.cpu.pid. If the subsequent posix_cpu_timer_set() call fails, the function returns immediately without calling posix_cpu_timer_del() to release the pid reference, causing a leak.

Fix it by calling posix_cpu_timer_del() before the unlock-and-return on the error path, consistent with the other exit paths in the same function.

AnalysisAI

Resource reference leak in the Linux kernel's POSIX CPU timer subsystem allows a local unprivileged user to exhaust kernel pid references and cause a local denial of service. The flaw exists in do_cpu_nanosleep() across all stable kernel branches from 2.6.12 onward: when posix_cpu_timer_set() returns an error, the pid reference acquired by the preceding posix_cpu_timer_create() call is never released. No public exploit code exists and EPSS sits at 0.22%, consistent with a kernel stability regression fix rather than an actively targeted security flaw.

Technical ContextAI

The vulnerability is in kernel/time/posix-cpu-timers.c within the Linux kernel's POSIX CPU timer implementation. The function do_cpu_nanosleep() creates a CPU timer via posix_cpu_timer_create(), which calls get_pid() to acquire a pid reference stored in timer.it.cpu.pid. If the subsequent posix_cpu_timer_set() call fails, the error path returns without invoking posix_cpu_timer_del(), which is responsible for releasing the pid reference on all other exit paths. This is a classic resource management error - most closely matching CWE-772 (Missing Release of Resource after Effective Lifetime), though the CVE lists CWE as N/A. The fix adds a posix_cpu_timer_del() call on the failing error path, making it consistent with the function's other cleanup paths. Affected CPE: cpe:2.3:a:linux:linux:* across all branches from the initial kernel commit.

RemediationAI

Update the Linux kernel to a patched stable release appropriate for the deployed branch: 5.10.261 or later, 5.15.212 or later, 6.1.178 or later, 6.6.145 or later, 6.12.96 or later, 6.18.39 or later, or 7.1.4 or later. Ubuntu users should apply patches per USN-8726-1 (https://ubuntu.com/security/notices/USN-8726-1) and USN-8727-1 (https://ubuntu.com/security/notices/USN-8727-1). Siemens customers should consult SSA-019113 (https://cert-portal.siemens.com/productcert/html/ssa-019113.html). The upstream fixes are available as stable commits, for example afed3cdc1cca133f804fcf57ff228974f424b23a and eb4cec29a78334d09bcfb41c0660cdd62ba05843 at git.kernel.org/stable. No syscall-level workaround is practical for general-purpose systems; containerized workloads with strict seccomp profiles that deny POSIX timer syscalls (timer_create, clock_nanosleep) would not be exposed, but this restriction breaks legitimate application use.

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected

Share

CVE-2026-64370 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy