Executive brief
The Linux kernel's getitimer() function, which allows applications to query timer settings, could leak uninitialized kernel memory to userspace on certain architectures (particularly sparc64). An unprivileged application can call getitimer() to read padding bytes that contain remnants of previous kernel state, exposing sensitive information that should not be accessible from user code.
Technical details
The vulnerability is an information disclosure (CWE-665) in the kernel's timer subsystem. The put_itimerval() function in kernel/time/itimer.c creates a stack-allocated struct __kernel_old_itimerval but only initializes the named fields (it_interval, it_value), leaving implicit padding holes uninitialized. On sparc64, the struct contains a 4-byte padding hole after tv_usec due to alignment differences (64-bit tv_sec vs. 32-bit __kernel_suseconds_t). When this structure is copied to userspace via copy_to_user(), the uninitialized padding bytes are exposed. The fix initializes the entire structure to zero (struct v = {}) before populating fields. Attack vector is local/network (getitimer is callable by any user process) with no special privileges required.
Affected products
- Linux Linux kernel All versions (patched in 6.11+)
Timeline
- 2026-09-11: disclosed
- 2026-08-09: patched: Fix committed upstream; backported to stable branches