The Linux kernel's update_rlimit_cpu() function incorrectly performs a 32-bit multiplication when converting RLIMIT_CPU values to nanoseconds on 32-bit kernels. Specifically, both operands are 32-bit unsigned longs, causing truncation for values greater than 4 seconds before widening to 64-bit. This results in the CPUCLOCK_PROF expiry cache being programmed with a prematurely truncated value, causing CPU timers to fire earlier than intended for RLIMIT_CPU soft limits of 5 seconds or more. The enforcement logic itself uses 64-bit multiplication and remains correct, so the vulnerability only affects timer expiry programming, not limit enforcement. 64-bit kernels are unaffected. The fix applies a 64-bit cast to the multiplication in update_rlimit_cpu() to align with the correct computation in check_process_timers().

On affected 32-bit Linux kernels, CPU timers may expire prematurely for processes with RLIMIT_CPU soft limits of 5 seconds or more, potentially causing unexpected SIGXCPU or SIGKILL signals earlier than intended. This could lead to premature termination or interruption of processes relying on CPU time limits. However, the actual enforcement of CPU time limits remains correct, so the vulnerability does not allow bypassing or extending CPU limits. 64-bit kernels are not affected.

A fix has been applied to the Linux kernel source code to cast the multiplication operands to 64-bit in update_rlimit_cpu(), correcting the timer expiry programming on 32-bit kernels. Users should update to a Linux kernel version that includes this fix. Since this is a kernel-level issue, applying the official kernel patch or upgrading to a fixed kernel release is the recommended remediation. No additional mitigation is required beyond applying the official fix.