CVE-2022-50095: 
Linux Kernel vulnerability analysis and mitigation

In the Linux kernel, a vulnerability was discovered in the posix-cpu-timers subsystem related to CPU timer handling during process execution. The issue was identified and resolved in June 2025. The vulnerability affects the Linux kernel's timer management functionality during exec operations (NVD, Wiz).

The vulnerability was introduced by commit 55e8c8eb2c7b which changed the timer deletion mechanism to look up tasks by PID instead of task pointers. When a non-leader thread calls execve(), it switches PIDs with the leader process. During exit_itimers, posix_cpu_timer_del cannot find the task because the timer still references the old PID. This results in armed timers not being disarmed and remaining in the timerqueue_list while their memory is freed (NVD, Wiz).

The vulnerability leads to a use-after-free condition when the timerqueue_list is processed after the memory has been released. This could potentially result in system crashes or other undefined behavior (NVD, Wiz).

The fix involves cleaning up the timers from the de-threaded task before freeing them, which prevents the use-after-free condition. This was implemented through a patch in the Linux kernel (NVD).