CVE-2026-64370
Description
In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path In do_cpu_nanosleep(), posix_cpu_timer_create() takes a pid reference via get_pid() and stores it in timer.it.cpu.pid. If the subsequent posix_cpu_timer_set() call fails, the function returns immediately without calling posix_cpu_timer_del() to release the pid reference, causing a leak. Fix it by calling posix_cpu_timer_del() before the unlock-and-return on the error path, consistent with the other exit paths in the same function.
How to fix
- linux linux_kernel5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4 or later
- git.kernel.org/stable/c/7776f9226e99eb49d97492b0b445027cfcb189da
- git.kernel.org/stable/c/87bd2ad568e15b90d5f7d4bcd70342d05dad649c
- git.kernel.org/stable/c/8a270b1258797f61b61da44f8bfd41a581b5c85b
- git.kernel.org/stable/c/8f06363446c5d043c9a7c008b250040e9de98cf9
- git.kernel.org/stable/c/afed3cdc1cca133f804fcf57ff228974f424b23a
- git.kernel.org/stable/c/d605d00085adc3fddf67de01dc2a44aebf1a3fb5
- git.kernel.org/stable/c/e5ffc638faf5dc7d9dc85c9a95e10bf97442e0c0
- git.kernel.org/stable/c/eb4cec29a78334d09bcfb41c0660cdd62ba05843
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | 2.6.12.1 ≤ v < 5.10.261, 5.11 ≤ v < 5.15.212, 5.16 ≤ v < 6.1.178, 6.2 ≤ v < 6.6.145, 6.7 ≤ v < 6.12.96, 6.13 ≤ v < 6.18.39, 6.19 ≤ v < 7.1.4, 2.6.12 | 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.