Linux Kernel EUVD-2026-93188

Requires local code execution as an unprivileged user able to use timer_create(CLOCK_THREAD_CPUTIME_ID)/timer_settime() and execve(). The bug only manifests when a non-leader thread exec()s AND one of the post-point_of_no_return steps (unshare_files, set_mm_exe_file, exec_mmap, or exec_task_namespaces) fails, AND the task is forced into do_exit() (e.g., via a SIGKILL landing in that window) before begin_new_exec() reaches posix_cpu_timers_exit(). Limiting factors: it is not remotely reachable (AV:L), needs a valid local account (PR:L), and depends on winning a narrow timing race around a failing exec path, so it is not exploitable against default idle systems without attacker-driven conditions. Unaffected are kernels already at the fixed stable releases (e.g., 6.6.158, 6.12.112, 6.18.54, 7.2.8) or where de_thread timing cannot be influenced.

This is a local, memory-corruption (use-after-free) flaw in the Linux kernel's exec()/POSIX CPU-timer cleanup path, not a remotely reachable issue. The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H, score 7.8) correctly scopes it as local and requiring an authenticated low-privileged user, with high impact consistent with a kernel UAF that can corrupt an rbtree and lead to privilege escalation or denial of service. However, the exploitation-probability signals all point to low real-world priority: EPSS is only 0.18% (6th percentile), the CVE is NOT on the CISA KEV list, and no public exploit code is referenced. Importantly, the CVSS AC:L rating understates reality - the description describes a genuine race condition that requires one of several exec() sub-steps (unshare_files/set_mm_exe_file/exec_mmap/exec_task_namespaces) to fail AND a SIGKILL to land in a narrow window after de_thread() but before do_exit(), which in practice raises attack complexity. No SSVC decision data was provided. Net assessment: a legitimate high-severity kernel bug worth patching in normal cadence, but given low EPSS, no KEV, no POC, and the race-condition timing requirement, it is not an emergency-priority, mass-exploited issue.

A local unprivileged user creates a non-leader thread that arms a per-thread CPU timer (CLOCK_THREAD_CPUTIME_ID), then calls execve() while arranging for a later exec step to fail and for the thread to receive SIGKILL in the race window after de_thread(). The k_itimer is freed while its node is still queued, so when the task is reaped the kernel manipulates a freed rbtree node, yielding a use-after-free that can be leveraged for privilege escalation or a kernel crash. No public proof-of-concept is identified at time of analysis, and the required timing race makes reliable exploitation non-trivial.