CVE-2026-89765: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-89765 is a memory disclosure vulnerability in the Linux kernel's timers/itimer subsystem, specifically affecting the getitimer() system call on native sparc64 architectures. The root cause is that put_itimerval() copies a stack-allocated __kernel_old_itimerval structure to userspace without zero-initializing it first, exposing up to two four-byte padding holes present in struct __kernel_old_timeval on sparc64 (where tv_sec is 64-bit but __kernel_suseconds_t is 32-bit). The vulnerability affects the Linux kernel from version 2.6.12 up to the patched stable releases. It was published on September 11, 2026, with patches available across multiple stable branches. The CVSS category is estimated as Medium, with an EPSS score of approximately 0.19% (Github Advisory, Feedly).

The vulnerability is classified as CWE-201 (Insertion of Sensitive Information Into Sent Data). On native sparc64, struct __kernel_old_timeval has a four-byte alignment hole after tv_usec because tv_sec is a 64-bit type while __kernel_suseconds_t is 32-bit. The put_itimerval() function allocates a __kernel_old_itimerval on the kernel stack, assigns only the named fields (it_interval and it_value), and then copies the entire structure — including uninitialized padding bytes — to userspace via copy_to_user(). The fix zero-initializes the aggregate structure before field assignment, ensuring padding bytes are deterministically zeroed before crossing the user/kernel boundary (Github Advisory, Feedly).

Any local user on an affected sparc64 system can invoke getitimer() to read uninitialized kernel stack memory through the padding holes in the returned structure, potentially disclosing sensitive kernel data such as cryptographic keys, pointers, or other secrets that happened to reside in the stack memory at the time of the call. The impact is limited to confidentiality — there is no integrity or availability impact, and exploitation does not enable code execution or privilege escalation directly. The vulnerability is architecture-specific, affecting only native sparc64 systems, which limits its overall scope (Feedly, Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (Feedly). The vulnerability requires local access to an affected sparc64 system and is exploitable by any unprivileged user who can invoke the getitimer() system call. The EPSS score is approximately 0.19% (10th percentile), indicating a low probability of exploitation in the near term (Github Advisory). No threat actor attribution or CISA KEV catalog listing has been identified for this CVE.

1. Identify target: Confirm the target system is running a native sparc64 Linux kernel version between 2.6.12 and the patched releases (prior to 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, or 7.2.4).
2. Obtain local access: Gain a local shell on the target system as any unprivileged user — no elevated privileges are required.
3. Invoke getitimer(): Write a small C program or use a scripting interface to call getitimer(ITIMER_REAL, &value) (or other timer types), capturing the full raw bytes of the returned itimerval structure.
4. Extract padding bytes: Parse the returned structure to isolate the four-byte padding holes after tv_usec in each timeval sub-structure, which contain uninitialized kernel stack data.
5. Analyze leaked data: Repeat the call multiple times to collect different kernel stack contents, potentially recovering sensitive values such as kernel pointers (useful for KASLR bypass) or fragments of cryptographic material (Feedly, Github Advisory).

Patches have been backported to multiple Linux stable branches; the fixed versions are 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1 (Github Advisory, Feedly). Administrators should update to a patched kernel version as the primary remediation. As a temporary workaround where upgrading is not immediately possible, access to the getitimer() system call can be restricted using seccomp profiles or other syscall filtering mechanisms to prevent unprivileged users from invoking it (Feedly). Red Hat has also tracked this issue via Bugzilla (Red Hat Bugzilla).