Executive brief
A vulnerability in the Linux kernel's timing system could allow a local user to cause a resource leak. Specifically, when certain timer operations fail, the system fails to release a reference to a process ID (PID). Over time, this could lead to system instability or resource exhaustion as the kernel fails to properly clean up internal identifiers.
Technical details
A reference count leak exists in kernel/time/posix-cpu-timers.c within the do_cpu_nanosleep() function. The function calls posix_cpu_timer_create(), which increments a PID reference count via get_pid(). If a subsequent call to posix_cpu_timer_set() fails, the function returns an error without calling posix_cpu_timer_del() to decrement the reference count. This results in a PID reference leak. An attacker with local access could potentially trigger this error path repeatedly to exhaust kernel resources. Patches have been released for various stable kernel branches including 5.10.y, 5.15.y, 6.1.y, 6.6.y, and 6.10.y.
Affected products
- Linux Linux Kernel 2.6.12 to 6.10.x
Timeline
- 2026-06-12: disclosed: Vulnerability reported by WenTao Liang
- 2026-07-18: patched: Fix committed to stable kernel trees
- 2026-07-25: advisory: CVE-2026-64370 published
References
- https://git.kernel.org/stable/c/7776f9226e99eb49d97492b0b445027cfcb189da
- https://git.kernel.org/stable/c/87bd2ad568e15b90d5f7d4bcd70342d05dad649c
- https://git.kernel.org/stable/c/8a270b1258797f61b61da44f8bfd41a581b5c85b
- https://git.kernel.org/stable/c/8f06363446c5d043c9a7c008b250040e9de98cf9
- https://git.kernel.org/stable/c/afed3cdc1cca133f804fcf57ff228974f424b23a
- https://git.kernel.org/stable/c/d605d00085adc3fddf67de01dc2a44aebf1a3fb5
- https://git.kernel.org/stable/c/e5ffc638faf5dc7d9dc85c9a95e10bf97442e0c0