In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path In… (CVE-2026-64370)
Source GCVE Database
No CVSS score published yet
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 2% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
AI-suggested
A fix has been implemented in the Linux kernel to properly release the pid reference on the error path in do_cpu_nanosleep(). Users should apply the official kernel update or patch that includes this fix once available. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor or kernel mailing list advisories for the current remediation guidance.
Description
A vulnerability in the Linux kernel's posix-cpu-timers subsystem caused a pid reference count leak in the do_cpu_nanosleep() error path. Specifically, if posix_cpu_timer_set() fails after a pid reference is taken, the reference is not released, leading to a resource leak. This issue has been resolved by ensuring the pid reference is properly released on error paths.
Impact
The vulnerability causes a pid reference count leak in the kernel, which could lead to resource exhaustion or instability over time if the error path is triggered repeatedly. There is no indication of direct privilege escalation or code execution impact. No known exploits in the wild have been reported.
Summary
The Linux kernel's posix-cpu-timers code in do_cpu_nanosleep() takes a pid reference via get_pid() and stores it in timer.it.cpu.pid. If the subsequent call to posix_cpu_timer_set() fails, the function previously returned immediately without releasing the pid reference by calling posix_cpu_timer_del(), causing a reference count leak. The fix involves calling posix_cpu_timer_del() before returning on the error path, aligning with other exit paths in the function to prevent the leak.
References
- nvd.nist.gov/vuln/detail/CVE-2026-64370 (opens in a new tab)
- git.kernel.org/stable/c/7776f9226e99eb49d97492b0b445027cfcb189da (opens in a new tab)
- git.kernel.org/stable/c/87bd2ad568e15b90d5f7d4bcd70342d05dad649c (opens in a new tab)
- git.kernel.org/stable/c/8a270b1258797f61b61da44f8bfd41a581b5c85b (opens in a new tab)
- git.kernel.org/stable/c/8f06363446c5d043c9a7c008b250040e9de98cf9 (opens in a new tab)
- git.kernel.org/stable/c/afed3cdc1cca133f804fcf57ff228974f424b23a (opens in a new tab)
- git.kernel.org/stable/c/d605d00085adc3fddf67de01dc2a44aebf1a3fb5 (opens in a new tab)
- git.kernel.org/stable/c/e5ffc638faf5dc7d9dc85c9a95e10bf97442e0c0 (opens in a new tab)
- git.kernel.org/stable/c/eb4cec29a78334d09bcfb41c0660cdd62ba05843 (opens in a new tab)
- cert-portal.siemens.com/productcert/html/ssa-019113.html (opens in a new tab)