ZeroDay Findings
Sign inSign up

Findings

CVE-2026-64370

posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path

Published Jul 25, 2026 · updated Oct 15, 2026 · Linux Linux

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path In do_cpu_nanosleep(), posix_cpu_timer_create() takes a pid reference via get_pid() and stores it in timer.it.cpu.pid. If the subsequent posix_cpu_timer_set() call fails, the function returns immediately without calling posix_cpu_timer_del() to release the pid reference, causing a leak. Fix it by calling posix_cpu_timer_del() before the unlock-and-return on the error path, consistent with the other exit paths in the same function.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Jul 25, 2026 · NIST NVD

    Detected

    In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path In do_cpu_nanosleep(), posix_cpu_timer_create() takes a pid reference via get_pid() and stores it in timer.it.cpu.pid. If the subsequent posix_cpu_timer_set() call fails, the function returns immediately without calling posix_cpu_timer_del() to release the pi

  2. Oct 15, 2026 · NIST NVD

    Updated

    In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path In do_cpu_nanosleep(), posix_cpu_timer_create() takes a pid reference via get_pid() and stores it in timer.it.cpu.pid. If the subsequent posix_cpu_timer_set() call fails, the function returns immediately without calling posix_cpu_timer_del() to release the pi

Affected

  • cpe linux/linux kernelversion unspecified
  • cpe linux/linux kernel2.6.12
  • vendor Linux Linuxversion unspecified

Sources

  • CIRCL Vulnerability LookupVulnerability recordCVE-2026-64370

    In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path In do_cpu_nanosleep(), posix_cpu_timer_create() takes a pid reference via get_pid() and stores it in timer.it.cpu.pid. If the subsequent po

    vulnerability.circl.lu
  • CVE.orgVulnerability recordCVE-2026-64370

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-64370

    30-day exploitation probability 0.1%

    first.org
  • NIST NVDVulnerability recordCVE-2026-64370

    In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path In do_cpu_nanosleep(), posix_cpu_timer_create() takes a pid reference via get_pid() and stores it in timer.it.cpu.pid. If the subsequent

    nvd.nist.gov

References