CVE-2026-64560: UAF in Linux Kernel POSIX Timers

UAF vulnerability in Linux kernel POSIX timers with CVSS 7.8 caused by non-leader exec() race condition

CVE-2026-64560 is a Use-After-Free vulnerability in the Linux kernel's posix-cpu-timers subsystem. It arises from a race condition between exec() operations in non-leader processes and timer management. When a non-leader process executes exec(), the kernel changes the thread group leader, but a race condition allows sys_timer_delete() to access freed memory. It primarily affects Linux administrators and infrastructure teams managing multi-threaded workloads.

With CVSS 7.8 (High), CVE-2026-64560 is a significant threat. It was resolved in Linux kernel upstream through structured fixes introducing correct memory ordering. Published to NVD on 2026-07-29, a recent GitHub signal (2026-10-30) indicates current interest in the vulnerability. Administrators of critical systems should prioritize this CVE in patch assessments.

IT administrators and CISOs must: 1) Verify kernel versions on critical Linux servers, consulting official changelogs for posix-timers patches; 2) Apply priority kernel updates through change management processes, testing in non-production environments; 3) Monitor systems for anomalous crashes or performance degradation; 4) Document residual risk and communicate status to business lines affected by multi-threaded workloads.

At a glance

What: Use-After-Free (UAF) vulnerability in the Linux kernel's posix-cpu-timers subsystem, caused by a race condition between exec() operations in non-leader processes and timer management. CVE-2026-64560 affects memory handling of POSIX timers during thread group leader changes.
Severity: CVSS 7.8 (High). The vulnerability enables a Use-After-Free condition that could be exploited for denial of service or potentially local privilege escalation. Impact is limited to local systems.
Affected versions: Not explicitly specified in NVD documentation. The vulnerability is described as historical, originating from a 2010 workaround for multi-threaded exec() issues. Affects Linux kernel in general, likely versions preceding specific upstream kernel patches.
Fix: The fix involves using smp_store_release() in __exit_signal(), adding smp_acquire__after_ctrl_dep() in the !sighand path of lock_task_sighand(), and a helper function that retries task lookup if sighand == NULL, gracefully handling the non-leader exec() case.
Status: Vulnerability published to NVD on 2026-07-29. Resolved in Linux kernel upstream through structured patching. Current status is 'fixed' in updated kernel branches.
Action: Administrators and CISOs must verify their Linux kernels are updated with posix-cpu-timers subsystem patches. Check kernel changelogs for versions resolving the exec() vs. timer race condition. Apply critical kernel patches via standard update management. Monitor systems for anomalous timer activity.

Sources: NVD, CVE-2026-64560

← All articles