CVE-2026-64560: 
Linux Kernel Schwachstellenanalyse und -minderung

CVE-2026-64560 is a use-after-free (UAF) vulnerability in the Linux kernel's POSIX CPU timer subsystem (posix-cpu-timers), triggered by a race condition between a non-leader thread's exec() call and sys_timer_delete(). The flaw was reported by researchers Wongi and Jungwoo and disclosed on July 29, 2026. It affects Linux kernel versions from 5.7 up to (but not including) the patched commits, with fixes available in stable branches targeting kernel 7.1.5 and 7.2-rc3. The vulnerability carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is a signal handler race condition (CWE-364) in the kernel's POSIX CPU timer handling. During a non-leader exec(), de_thread() calls switch_leader() and subsequently release_task(old_leader), which sets old_leader->sighand = NULL. Concurrently, sys_timer_delete() may observe the old leader via pid_task(), attempt to lock its sighand, find it NULL, and return early — freeing the underlying POSIX timer object via free_posix_timer() without removing it from the timer queue. If the deleted timer was armed and enqueued in p->signal (inherited on exec()), subsequent calls to run_posix_cpu_timers() or any timerqueue add/delete operations will dereference the freed timer object's timerqueue node, resulting in a UAF. A similar UAF exists in posix_cpu_timer_set() via do_cpu_nanosleep(), and on weakly ordered architectures, a false-positive WARN_ON_ONCE can also be triggered in posix_cpu_timer_del() (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation allows a local attacker with low privileges to trigger a use-after-free condition in kernel memory, potentially leading to arbitrary kernel code execution, privilege escalation to root, or a kernel panic causing a system crash. All three CIA pillars are affected: confidentiality (kernel memory disclosure), integrity (arbitrary kernel writes), and availability (system crash). The attack is confined to the local system but could enable full privilege escalation and lateral movement within a compromised host (GitHub Advisory, Red Hat Bugzilla).

1. Gain local access: Obtain a low-privileged shell on a vulnerable Linux system (kernel 5.7 through the unpatched versions).
2. Create a multi-threaded process: Spawn a process with multiple threads, ensuring one thread is not the thread group leader.
3. Create and arm a POSIX CPU timer: Use timer_create() targeting the TGID (thread group ID) and arm it with timer_settime() so it is enqueued in p->signal.
4. Race exec() with timer deletion: From the non-leader thread, call exec() to trigger de_thread() → switch_leader() → release_task(old_leader), while simultaneously calling sys_timer_delete() on the armed timer from another thread.
5. Trigger UAF: The race causes sys_timer_delete() to free the POSIX timer object while it remains enqueued in the inherited signal structure. Subsequent run_posix_cpu_timers() or timerqueue operations dereference the freed object.
6. Achieve kernel code execution or crash: Exploit the freed memory region (e.g., via heap spray or controlled reallocation) to redirect kernel execution flow, escalate privileges, or cause a denial of service (GitHub Advisory, Red Hat Bugzilla).

• Logs: Kernel oops or BUG messages in dmesg or /var/log/kern.log referencing posix_cpu_timer_del, run_posix_cpu_timers, or timerqueue operations with use-after-free or invalid memory access traces.
• Logs: WARN_ON_ONCE kernel warnings related to timer_queued in posix_cpu_timer_del on weakly ordered architectures.
• Process: Unexpected privilege escalation by a low-privileged process, particularly one that spawned multiple threads and called exec() from a non-leader thread.
• System: Sudden kernel panics or system crashes on multi-threaded workloads involving POSIX CPU timers, especially during exec() calls in multi-threaded processes.

Kernel patches have been committed to the stable tree: commit ad1cafa1bdaa71da85d71cac053838bbe97852b6 and 920f893f735e92ba3a1cd9256899a186b161928d address the issue, with fixes included in kernel 7.1.5 and 7.2-rc3. Administrators should update to a patched kernel version as soon as it is available for their distribution. As a temporary workaround, restrict execution of untrusted multi-threaded applications and limit the use of POSIX CPU timers in environments where non-leader exec() operations are common. Red Hat has tracked this issue and users should monitor their vendor's advisory channels for distribution-specific updates (GitHub Advisory, Red Hat Bugzilla).

Red Hat has filed a security tracking bug (Bugzilla #2508504) and assigned medium priority/severity, with the upstream kernel advisory referenced via the linux-cve-announce mailing list. No notable public researcher commentary or significant social media discussion has been observed at this time beyond standard CVE aggregator coverage (Red Hat Bugzilla).