Linux Kernel: Race Condition (CVE-2026-64560)

What is affected, what to do

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by non-leader exec() race Wongi and Jungwoo decoded and reported a non-leader exec() related race which can result in an UAF: sys_timer_delete() exec() posix_cpu_timer_del() // Observes old leader p = pid_task(pid, pid_type); de_thread() switch_leader(); release_task(old_leader) __exit_signal(old_leader) sighand = lock(old_leader, sighand); posix_cpu_timers*_exit(); sighand = lock_task_sighand(p) unhash_task(old_leader); sh = lock(p, sighand) old_leader->sighand = NULL; unlock(sighand); (p->sighand == NULL) unlock(sh) return NULL; // Returns without action if(!sighand) return 0; free_posix_timer(); This is "harmless" unless the deleted timer was armed and enqueued in p->signal because on exec() a TGID targeted timer is inherited. As sys_timer_delete() freed the underlying posix timer object run_posix_cpu_timers() or any timerqueue related add/delete operations on other timers will access the freed object's timerqueue node, which results in an UAF.

An exploit is publicly available. Update Linux Kernel to version 5.10.262, Linux Kernel to version 5.15.213, Linux Kernel to version 6.1.180.

Affected

• Linux Kernel lt 5.7..5.10.262
• Linux Kernel lt 5.11..5.15.213
• Linux Kernel lt 5.16..6.1.180
• Linux Kernel lt 6.2..6.6.147
• Linux Kernel lt 6.7..6.12.100
• Linux Kernel lt 6.13..6.18.41
• Linux Kernel lt 6.19..7.1.5

Fixed in

• Linux Kernel 5.10.262
• Linux Kernel 5.15.213
• Linux Kernel 6.1.180
• Linux Kernel 6.6.147
• Linux Kernel 6.12.100
• Linux Kernel 6.18.41
• Linux Kernel 7.1.5
• Linux Kernel 7.2

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

High technical severity: assess and remediate the vulnerability in vulnerability handling under Art. 21(2)(e) NIS2 and document the decision.

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

From 11.12.2027, Annex I Part II CRA requires manufacturers of affected products with digital elements to handle vulnerabilities without delay and provide security updates.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by non-leader exec() race Wongi and Jungwoo decoded and reported a non-leader exec() related race which can result in an UAF: sys_timer_delete() exec() posix_cpu_timer_del() // Observes old leader p = pid_task(pid, pid_type); de_thread() switch_leader(); release_task(old_leader) __exit_signal(old_leader) sighand = lock(old_leader, sighand); posix_cpu_timers*_exit(); sighand = lock_task_sighand(p) unhash_task(old_leader); sh = lock(p, sighand) old_leader->sighand = NULL; unlock(sighand); (p->sighand == NULL) unlock(sh) return NULL; // Returns without action if(!sighand) return 0; free_posix_timer(); This is "harmless" unless the deleted timer was armed and enqueued in p->signal because on exec() a TGID targeted timer is inherited. As sys_timer_delete() freed the underlying posix timer object run_posix_cpu_timers() or any timerqueue related add/delete operations on other timers will access the freed object's timerqueue node, which results in an UAF. There is a similar problem vs. posix_cpu_timer_set(). For regular posix timers it just transiently returns -ESRCH to user space, but for the use case in do_cpu_nanosleep() it's the same UAF just that the k_itimer is allocated on the stack. Also posix_cpu_timer_rearm() fails to rearm the timer, which means it stops to expire. While debating solutions Frederic pointed out another problem: posix_cpu_timer_del(tmr) __exit_signal(p) posix_cpu_timers*_exit(p); unhash_task(p); p->sighand = NULL; sh = lock_task_sighand(p) sighand = p->sighand; if (!sighand) return NULL; lock(sighand); if (!sh) WARN_ON_ONCE(timer_queued(tmr)); On weakly ordered architectures it is not guaranteed that posix_cpu_timer_del() will observe the stores in posix_cpu_timers*_exit() when p->sighand is observed as NULL, which means the WARN() can be a false positive. Solve these issues by: 1) Changing the store in __exit_signal() to smp_store_release(). 2) Adding a smp_acquire__after_ctrl_dep() into the !sighand path of lock_task_sighand(). 3) Creating a helper function for looking up the task and locking sighand which does not return when sighand == NULL. Instead it retries the task lookup and only if that fails it gives up. 4) Using that helper in the three affected functions. #1/#2 ensures that the reader side which observes sighand == NULL also observes all preceeding stores, i.e. the stores in posix_cpu_timers*_exit() and the ones in unhash_task(). #3 ensures that the above described non-leader exec() situation is handled gracefully. When the task lookup returns the old leader, but sighand == NULL then it retries. In the non-leader exec() case the subsequent task lookup will observe the new leader due to #1/#2. In normal exit() scenarios the subsequent lookup fails. When the task lookup fails, the function also checks whether the timer is still enqueued and issues a warning if that's the case. Unfortunately there is nothing which can be done about it, but as the task is already not longer visible the timer should not be accessed anymore. This check also requires memory ordering, which is not provided when the first lookup fails. To achieve that the check is preceeded by a smp_rmb() which pairs with the smp_wmb() in write_seqlock() in __exit_signal(). That ensures that the stores in posix_cpu_timers*_exit() are visible. The history of the non-leader exec() issue goes back to the early days of posix CPU timers, which stored a pointer to the group leader task in the timer. That obviously fails when a non-leader exec() switches the leader. commit e0a70217107e ("posix-cpu-timers: workaround to suppress the problems with mt exec") added a temporary workaround for that in 2010 which surv ---truncated---

Source: suse_csaf, siemens_advisory, HKCERT (CC BY 3.0 HK) · HKCERT rating: medium, Ubuntu Security Notices, redhat_csaf, Debian LTS Advisories, Debian Security Advisories, BSI WID Portal, BSI CSAF, cvelistv5, Microsoft Security Update Guide, OSV (Open Source Vulnerabilities), NVD (NIST), CVE.org (MITRE)

Vendors and products

• Android :linux Kernel:
• Debian Linux
• Debian Linux-6.1
• Debian Linux-6.12
• Google Google Android
• Google Android 14
• Google Android 15
• Google Android 16
• Google Android 17
• Google Android Automotive OS
• Google Android Xr
• IBM Datapower Gateway

Weakness classes (CWE)

• CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

  Class

  The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

  Entry at MITRE CWE-362

References & sources

• git.kernel.orgstable/c/ad1cafa1bdaa71da85d71cac053838bbe97852b6
• git.kernel.orgstable/c/920f893f735e92ba3a1cd9256899a186b161928d
• git.kernel.orgstable/c/67aa823e3e8c229c6d374df79c804f6721cb83b6
• git.kernel.orgstable/c/d8bcb28abad857f1415da7656f19b2ada90af04f
• git.kernel.orgstable/c/cc35ddbc497311e0b6b9a6a6a4f4d1217d6ab1aa
• git.kernel.orgstable/c/12a891c773aeb5823d63dbd0cb2ab931d6c21c9b
• git.kernel.orgstable/c/e74443f5db0037c556ef436fa64b88bf4ea08f83
• git.kernel.orgstable/c/6a7ecc25abe6f0fecc6e62a05096987200edbd02
• Siemens ProductCERTproductcert/html/ssa-019113.html
• Siemens ProductCERTproductcert/html/ssa-457936.html
• Siemens ProductCERTproductcert/html/ssa-784472.html
• source.android.comsecurity/bulletin/2026-11-01advisory
• android.googlesource.comkernel/common/+/585f2c9c9560f7e0dadafbba251183cea83d9dc4fix
• android.googlesource.comkernel/common/+/8eff909dd82da10a599468a514cc1ad07e90c3ccfix

Changes to this CVE

Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

1. 19.10.2026Record modifiedCISA ADP

   Weakness type: CWE-362

   Show the original change

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Weakness type (CWE)	added	—	CWE-362

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

2. 16.10.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: none known, automatable: no

   Show the original change

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   SSVC assessment	added	—	{"id":"CVE-2026-64560","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-10-16T15:42:46.237776Z"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

3. 15.10.2026Record modifiedSiemens ADP

   New references:

   • https://cert-portal.siemens.com/productcert/html/ssa-457936.html
   • https://cert-portal.siemens.com/productcert/html/ssa-784472.html
   Show 3 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Affected versions (publisher)	added	—	Affected value modified. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/64xxx/CVE-2026-64560.json">CVE-2026-64560</a>
   Reference	added	—	https://cert-portal.siemens.com/productcert/html/ssa-457936.html
   Reference	added	—	https://cert-portal.siemens.com/productcert/html/ssa-784472.html

   Source identifier: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e

4. 08.09.2026Record modifiedLinux

   New references:

   • https://git.kernel.org/stable/c/12a891c773aeb5823d63dbd0cb2ab931d6c21c9b
   • https://git.kernel.org/stable/c/67aa823e3e8c229c6d374df79c804f6721cb83b6
   • https://git.kernel.org/stable/c/6a7ecc25abe6f0fecc6e62a05096987200edbd02
   • https://git.kernel.org/stable/c/920f893f735e92ba3a1cd9256899a186b161928d

   and 4 more references

   Show 16 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Reference	added	—	https://git.kernel.org/stable/c/12a891c773aeb5823d63dbd0cb2ab931d6c21c9b
   Reference	added	—	https://git.kernel.org/stable/c/67aa823e3e8c229c6d374df79c804f6721cb83b6
   Reference	added	—	https://git.kernel.org/stable/c/6a7ecc25abe6f0fecc6e62a05096987200edbd02
   Reference	added	—	https://git.kernel.org/stable/c/920f893f735e92ba3a1cd9256899a186b161928d
   Reference	added	—	https://git.kernel.org/stable/c/ad1cafa1bdaa71da85d71cac053838bbe97852b6
   Reference	added	—	https://git.kernel.org/stable/c/cc35ddbc497311e0b6b9a6a6a4f4d1217d6ab1aa
   Reference	added	—	https://git.kernel.org/stable/c/d8bcb28abad857f1415da7656f19b2ada90af04f
   Reference	added	—	https://git.kernel.org/stable/c/e74443f5db0037c556ef436fa64b88bf4ea08f83
   Reference	removed	https://git.kernel.org/stable/c/12a891c773aeb5823d63dbd0cb2ab931d6c21c9b	—
   Reference	removed	https://git.kernel.org/stable/c/67aa823e3e8c229c6d374df79c804f6721cb83b6	—
   Reference	removed	https://git.kernel.org/stable/c/6a7ecc25abe6f0fecc6e62a05096987200edbd02	—
   Reference	removed	https://git.kernel.org/stable/c/920f893f735e92ba3a1cd9256899a186b161928d	—
   Reference	removed	https://git.kernel.org/stable/c/ad1cafa1bdaa71da85d71cac053838bbe97852b6	—
   Reference	removed	https://git.kernel.org/stable/c/cc35ddbc497311e0b6b9a6a6a4f4d1217d6ab1aa	—
   Reference	removed	https://git.kernel.org/stable/c/d8bcb28abad857f1415da7656f19b2ada90af04f	—
   Reference	removed	https://git.kernel.org/stable/c/e74443f5db0037c556ef436fa64b88bf4ea08f83	—

   Source identifier: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

5. 08.09.2026Record modifiedSiemens ADP

   New references:

   • https://cert-portal.siemens.com/productcert/html/ssa-019113.html
   Show 2 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Affected versions (publisher)	added	—	New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/64xxx/CVE-2026-64560.json">CVE-2026-64560</a>
   Reference	added	—	https://cert-portal.siemens.com/productcert/html/ssa-019113.html

   Source identifier: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e