Executive brief
A race condition was discovered in the Linux kernel's handling of POSIX CPU timers during specific process operations. If a multi-threaded application performs an 'exec' operation while a timer is being deleted or modified, it can lead to a system crash or unpredictable behavior. This occurs because the system may attempt to access memory that has already been freed, potentially impacting system stability and availability.
Technical details
A use-after-free (UAF) vulnerability exists in the Linux kernel's posix-cpu-timers implementation due to a race condition between sys_timer_delete()/posix_cpu_timer_set() and a non-leader exec() call. When de_thread() switches the leader and releases the old leader, a concurrent timer deletion might observe the old leader's sighand as NULL and return without properly cleaning up armed timers. This results in the underlying posix timer object being freed while still enqueued in the timerqueue, leading to a UAF when run_posix_cpu_timers() or other queue operations are subsequently performed. The fix involves using smp_store_release() in __exit_signal(), adding memory barriers in lock_task_sighand(), and implementing a retry mechanism for task lookups to ensure the new leader is correctly identified.
Affected products
- Linux Linux kernel Impacts versions using pid-based posix-cpu-timers (introduced in 55e8c8eb2c7b)
Timeline
- 2026-07-03: patched: Initial patch by Thomas Gleixner
- 2026-07-29: advisory: CVE-2026-64560 published