The Linux kernel's do_cpu_nanosleep() function in the posix-cpu-timers subsystem improperly handles error conditions after acquiring a pid reference via get_pid(). If posix_cpu_timer_set() fails, the function returns without calling posix_cpu_timer_del() to release the pid reference, causing a reference count leak. The fix involves calling posix_cpu_timer_del() before returning on the error path, aligning with other exit paths in the function.

The vulnerability causes a pid reference count leak, which can lead to resource exhaustion over time if the error path is triggered repeatedly. There is no indication of direct code execution or privilege escalation from this leak. No known exploits are reported in the wild.

A fix has been implemented in the Linux kernel to address this issue by properly releasing the pid reference on error paths. Users should apply the official kernel updates that include this fix. Patch status is not explicitly confirmed in the provided data; check the vendor or Linux kernel advisories for the exact fixed versions and update accordingly.