CVE-2026-93146

time/namespace: Validate nanosecond field in proc_timens_set_offset()

State: Published
Severity: Not scored
Published: Sep 17, 2026
Updated: Oct 30, 2026
Reserved: Sep 17, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

time/namespace: Validate nanosecond field in proc_timens_set_offset()

The function validates tv_sec to be within [-KTIME_SEC_MAX, KTIME_SEC_MAX] but never validates that tv_nsec is within the valid range of [0, NSEC_PER_SEC-1] before using it in timespec64_add().

timespec64_add() expects both timespec64 structures to have normalized values with tv_nsec in the range [0, 999999999]. If off->val.tv_nsec contains invalid values (negative or >= NSEC_PER_SEC), it could lead to incorrect calculations or unexpected behavior.

Add validation to ensure tv_nsec is within the valid range before performing the addition.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	04a8682a71becdb639ec9c0d82b315a2baef7a5d to before ce0dd307dfa3193fbf06371b7c819a6bff7d3d68Affected 04a8682a71becdb639ec9c0d82b315a2baef7a5d to before 5b8a40de738b7c4896c2edbc6262bd1b3462ded0Affected 04a8682a71becdb639ec9c0d82b315a2baef7a5d to before b20d7085ab314672447322c10cc5d1ba443e3b8eAffected 04a8682a71becdb639ec9c0d82b315a2baef7a5d to before db667d2970c756cc7b483f45f272440f845a665bAffected 04a8682a71becdb639ec9c0d82b315a2baef7a5d to before 1f0c3c0c36c7aedf55a60d9c71c4bd258b8937ceAffected 04a8682a71becdb639ec9c0d82b315a2baef7a5d to before 06aba58e58492d2b8eae059274caed29025ea96eAffected
LinuxLinux	5.6Affected before 5.6Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.114 through 6.12.Not affected 6.18.52 through 6.18.Not affected 7.2.6 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

04a8682a71becdb639ec9c0d82b315a2baef7a5d to before ce0dd307dfa3193fbf06371b7c819a6bff7d3d68Affected
04a8682a71becdb639ec9c0d82b315a2baef7a5d to before 5b8a40de738b7c4896c2edbc6262bd1b3462ded0Affected
04a8682a71becdb639ec9c0d82b315a2baef7a5d to before b20d7085ab314672447322c10cc5d1ba443e3b8eAffected
04a8682a71becdb639ec9c0d82b315a2baef7a5d to before db667d2970c756cc7b483f45f272440f845a665bAffected
04a8682a71becdb639ec9c0d82b315a2baef7a5d to before 1f0c3c0c36c7aedf55a60d9c71c4bd258b8937ceAffected
04a8682a71becdb639ec9c0d82b315a2baef7a5d to before 06aba58e58492d2b8eae059274caed29025ea96eAffected

LinuxLinux

5.6Affected
before 5.6Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.114 through 6.12.*Not affected
6.18.52 through 6.18.*Not affected
7.2.6 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.