Linux Kernel posix-cpu-timers Use-After-Free Vulnerability

CVE-2026-64560 is a high-severity use-after-free (UAF) and race condition vulnerability within the Linux kernel's posix-cpu-timers subsystem. Introduced in kernel version 5.7, the flaw affects processes where a non-leader thread initiates an execve() system call, triggering a race condition between thread leader transition and timer deletion. Specifically, the function posix_cpu_timer_del() can incorrectly return early if it observes a null sighand pointer during a process transition, leaving a dangling reference to a k_itimer object within the process timer queue.

This vulnerability can lead to kernel crashes, panics, or potential security exploitation on Linux and Android systems. A public proof-of-concept (PoC) demonstrating the race condition is available on Sploitus, increasing the risk for unpatched systems. The issue has been addressed by Thomas Gleixner in the mainline kernel and backported to major stable branches, including 5.10, 5.15, 6.1, 6.6, 6.12, 6.18, and 7.1.

Attack Chain

1. Attacker identifies a target system running an unpatched Linux kernel (v5.7 through 7.1).
2. Attacker compiles and executes the PoC trigger on the target device, which initiates multiple concurrent threads.
3. One thread (the timer thread) creates and arms a CLOCK_PROCESS_CPUTIME_ID timer.
4. Another thread (the exec thread) performs a fork() followed by a non-leader thread execve().
5. The race condition occurs when posix_cpu_timer_del() observes the old leader process while de_thread() is switching the task leader.
6. The timer remains enqueued in the process timer queue due to the incomplete deletion, leaving a dangling pointer.
7. Subsequent timer ticks (run_posix_cpu_timers) or add/delete operations access the dangling k_itimer object, resulting in a use-after-free read/write.
8. Kernel memory corruption occurs, leading to system instability or potential code execution depending on the kernel state.

Impact

Successful exploitation of CVE-2026-64560 results in kernel memory corruption. While the public PoC is intended for research and trigger verification, it demonstrates the feasibility of triggering the UAF condition. On vulnerable systems, this can lead to system-wide denial-of-service (kernel panics), and in advanced scenarios, it provides a primitive that could be leveraged by local attackers for privilege escalation or sandbox escapes. Devices running Android with security patch levels (SPL) prior to August 2026 are likely affected.

Recommendation

• Upgrade Linux kernel versions immediately to the patched releases (e.g., 5.10.262, 5.15.213, 6.1.180, 6.6.147, 6.12.100, 6.18.41, 7.1.5 or later).
• Use the provided PoC's check mode to verify the vulnerability status of test devices.
• Review kernel logs for KASAN, use-after-free, or BUG/WARNING entries related to 'timer' or 'posix' on sensitive infrastructure.
• Monitor for the execution of unauthorized custom binaries or build scripts that attempt to use NDK or local kernel compilation tools.