CVE-2026-64370 Details
Description
In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path In do_cpu_nanosleep(), posix_cpu_timer_create() takes a pid reference via get_pid() and stores it in timer.it.cpu.pid. If the subsequent posix_cpu_timer_set() call fails, the function returns immediately without calling posix_cpu_timer_del() to release the pid reference, causing a leak. Fix it by calling posix_cpu_timer_del() before the unlock-and-return on the error path, consistent with the other exit paths in the same function.
A reference count leak vulnerability has been identified in the Linux kernel's handling of POSIX CPU timers. When the function 'do_cpu_nanosleep()' is called, it creates a PID reference that is stored in the timer structure. If an error occurs in a subsequent function call, the PID reference is not properly released, leading to a memory leak. This vulnerability affects the Linux kernel stable tree.
The vulnerability has been fixed in the Linux kernel stable tree by modifying the 'do_cpu_nanosleep()' function to ensure that the PID reference is properly released before exiting the function in case of an error.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cert-portal.siemens.com/productcert/html/ssa-019113.html | siemens-SADP | Third Party Advisory |
| https://git.kernel.org/stable/c/7776f9226e99eb49d97492b0b445027cfcb189da | kernel.org | Patch |
| https://git.kernel.org/stable/c/87bd2ad568e15b90d5f7d4bcd70342d05dad649c | kernel.org | Patch |
| https://git.kernel.org/stable/c/8a270b1258797f61b61da44f8bfd41a581b5c85b | kernel.org | Patch |
| https://git.kernel.org/stable/c/8f06363446c5d043c9a7c008b250040e9de98cf9 | kernel.org | Patch |
| https://git.kernel.org/stable/c/afed3cdc1cca133f804fcf57ff228974f424b23a | kernel.org | Patch |
| https://git.kernel.org/stable/c/d605d00085adc3fddf67de01dc2a44aebf1a3fb5 | kernel.org | Patch |
| https://git.kernel.org/stable/c/e5ffc638faf5dc7d9dc85c9a95e10bf97442e0c0 | kernel.org | Patch |
| https://git.kernel.org/stable/c/eb4cec29a78334d09bcfb41c0660cdd62ba05843 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-Other | Weakness Not in a Standard CWE Category | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 2.6.12.1, < 5.10.261 >= 5.11, < 5.15.212 >= 5.16, < 6.1.178 >= 6.2, < 6.6.145 >= 6.7, < 6.12.96 >= 6.13, < 6.18.39 >= 6.19, < 7.1.4 2.6.12 - 2.6.12 rc2 2.6.12 rc3 2.6.12 rc4 2.6.12 rc5 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 8, 2026 | Initial Analysis | [email protected] |
| Sep 8, 2026 | CVE Modified | kernel.org |
| Sep 8, 2026 | CVE Modified | siemens-SADP |
| Aug 17, 2026 | CVE Modified | kernel.org |
| Jul 25, 2026 | New CVE Received | kernel.org |