CVE-2026-64370

posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path

State: Published
Severity: Not scored
Published: Jul 25, 2026
Updated: Oct 15, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path

In do_cpu_nanosleep(), posix_cpu_timer_create() takes a pid reference via get_pid() and stores it in timer.it.cpu.pid. If the subsequent posix_cpu_timer_set() call fails, the function returns immediately without calling posix_cpu_timer_del() to release the pid reference, causing a leak.

Fix it by calling posix_cpu_timer_del() before the unlock-and-return on the error path, consistent with the other exit paths in the same function.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before afed3cdc1cca133f804fcf57ff228974f424b23aAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 8a270b1258797f61b61da44f8bfd41a581b5c85bAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before d605d00085adc3fddf67de01dc2a44aebf1a3fb5Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before e5ffc638faf5dc7d9dc85c9a95e10bf97442e0c0Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before eb4cec29a78334d09bcfb41c0660cdd62ba05843Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 7776f9226e99eb49d97492b0b445027cfcb189daAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 8f06363446c5d043c9a7c008b250040e9de98cf9Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 87bd2ad568e15b90d5f7d4bcd70342d05dad649cAffected
LinuxLinux	2.6.12Affected before 2.6.12Not affected 5.10.261 through 5.10.Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.96 through 6.12.Not affected 6.18.39 through 6.18.Not affected 7.1.4 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before afed3cdc1cca133f804fcf57ff228974f424b23aAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 8a270b1258797f61b61da44f8bfd41a581b5c85bAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before d605d00085adc3fddf67de01dc2a44aebf1a3fb5Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before e5ffc638faf5dc7d9dc85c9a95e10bf97442e0c0Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before eb4cec29a78334d09bcfb41c0660cdd62ba05843Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 7776f9226e99eb49d97492b0b445027cfcb189daAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 8f06363446c5d043c9a7c008b250040e9de98cf9Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 87bd2ad568e15b90d5f7d4bcd70342d05dad649cAffected

LinuxLinux

2.6.12Affected
before 2.6.12Not affected
5.10.261 through 5.10.*Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.96 through 6.12.*Not affected
6.18.39 through 6.18.*Not affected
7.1.4 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.