CVE-2026-64370: Linux Kernel Privilege Escalation Bug

CVE-2026-64370 Overview

CVE-2026-64370 is a memory leak vulnerability in the Linux kernel's posix-cpu-timers subsystem. The flaw resides in the do_cpu_nanosleep() function, where a PID reference obtained via get_pid() is not released along an error path. When posix_cpu_timer_create() succeeds and stores the PID reference in timer.it.cpu.pid, but the subsequent posix_cpu_timer_set() call fails, the function returns without invoking posix_cpu_timer_del(). The result is a persistent PID reference count leak each time the error condition is triggered from an unprivileged local context.

Critical Impact
Repeated triggering of the error path exhausts kernel PID reference tracking, degrading system stability and potentially leading to denial of service on long-running Linux hosts.

Affected Products

Linux kernel versions containing the vulnerable do_cpu_nanosleep() code path in posix-cpu-timers
Downstream distributions shipping the affected mainline and stable kernel trees
Systems relying on POSIX CPU timers for scheduling or workload management

Discovery Timeline

2026-07-25 - CVE-2026-64370 published to NVD
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64370

Vulnerability Analysis

The vulnerability is a kernel resource management defect classified as a memory leak. Specifically, it is a PID reference count leak occurring during error handling in the POSIX CPU nanosleep implementation. The function do_cpu_nanosleep() calls posix_cpu_timer_create(), which takes a PID reference through get_pid() and stores it in the timer structure at timer.it.cpu.pid. When posix_cpu_timer_set() subsequently fails, the original code returns immediately via an unlock-and-return sequence. This bypasses the corresponding posix_cpu_timer_del() call that would normally release the PID reference.

The fix modifies the error path to invoke posix_cpu_timer_del() before returning, aligning behavior with the other exit paths in the same function.

Root Cause

The root cause is asymmetric resource cleanup in error handling. The acquisition of the PID reference occurs implicitly inside posix_cpu_timer_create(), while the release depends on the caller correctly invoking posix_cpu_timer_del() on every failure path. The original implementation omitted this call on one specific branch, breaking the acquire-release contract for kernel PID references.

Attack Vector

Exploitation requires local access to invoke the clock_nanosleep() syscall against a CPU clock in a manner that causes posix_cpu_timer_set() to fail. An unprivileged local user can repeatedly trigger the error path in a loop, incrementally leaking PID references. Over time, this consumes kernel memory and may prevent proper release of process structures. The vulnerability is not remotely reachable and does not directly permit code execution or privilege escalation.

For technical details on the fix, refer to the upstream commits: Kernel Git Commit 7776f92 and Kernel Git Commit e5ffc63.

Detection Methods for CVE-2026-64370

Indicators of Compromise

Steady growth in kernel slab allocations associated with pid cache entries without corresponding process creation activity
Processes remaining in a defunct or referenced state despite parent cleanup, indicating dangling PID references
Unusual volume of clock_nanosleep() calls targeting CLOCK_PROCESS_CPUTIME_ID or CLOCK_THREAD_CPUTIME_ID from a single unprivileged process

Detection Strategies

Monitor /proc/slabinfo for abnormal expansion of the pid slab cache over time on affected kernels
Instrument syscall auditing to capture repeated clock_nanosleep() invocations with CPU clock identifiers from non-root users
Correlate kernel memory pressure events with process behavior patterns that iterate on timer creation and failure

Monitoring Recommendations

Establish baselines for kernel PID cache size and alert on sustained upward trends unrelated to workload changes
Track dmesg output for out-of-memory conditions or PID allocation warnings on long-running hosts
Review running kernel versions across the fleet to identify hosts requiring patch prioritization

How to Mitigate CVE-2026-64370

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable tree commits as soon as vendor-packaged updates become available
Inventory all Linux systems and identify kernels running vulnerable versions of posix-cpu-timers
Restrict local shell access on multi-tenant systems to reduce the population of untrusted users capable of triggering the leak

Patch Information

The fix has been merged into the stable Linux kernel trees. The patch adds a posix_cpu_timer_del() call before the unlock-and-return sequence on the error path in do_cpu_nanosleep(), ensuring the PID reference taken by posix_cpu_timer_create() is released. Relevant commits include Kernel Git Commit 87bd2ad, Kernel Git Commit 8a270b1, Kernel Git Commit 8f06363, Kernel Git Commit afed3cd, Kernel Git Commit d605d00, and Kernel Git Commit eb4cec2. Consult distribution vendors for backported packages targeting the specific kernel branch in use.

Workarounds

No functional workaround exists that fully prevents the leak without patching; upgrading the kernel is the correct remediation
On multi-tenant systems, apply resource controls via cgroups and ulimit to constrain per-user process and timer usage
Schedule periodic reboots on unpatched long-running hosts to reclaim leaked PID references until the patch is deployed

bash

# Verify running kernel version and check for vulnerable posix-cpu-timers code
uname -r

# Example: apply distribution kernel update (Debian/Ubuntu)
sudo apt update && sudo apt install --only-upgrade linux-image-$(uname -r | sed 's/-generic//')-generic

# Reboot to activate the patched kernel
sudo systemctl reboot