VYPR
← All advisories
Medium severity5.5NVD Advisory· Published Jul 25, 2026· Updated Oct 15, 2026

CVE-2026-64370

CVE-2026-64370

Description

In the Linux kernel, the following vulnerability has been resolved:

posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path

In do_cpu_nanosleep(), posix_cpu_timer_create() takes a pid reference via get_pid() and stores it in timer.it.cpu.pid. If the subsequent posix_cpu_timer_set() call fails, the function returns immediately without calling posix_cpu_timer_del() to release the pid reference, causing a leak.

Fix it by calling posix_cpu_timer_del() before the unlock-and-return on the error path, consistent with the other exit paths in the same function.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

9
  • osv-coords2 versions
    pkg:linux/kernelpkg:rpm/opensuse/kernel-source&distro=openSUSE%20Tumbleweed
    >= 2.6.12, < 5.10.261+ 1 more
    • (no CPE)range: >= 2.6.12, < 5.10.261
    • (no CPE)range: < 7.1.7-1.1
  • Linux/Kernel7 versions
    cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*+ 6 more
    • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*range: >=2.6.12.1,<5.10.261
    • cpe:2.3:o:linux:linux_kernel:2.6.12:-:*:*:*:*:*:*
    • cpe:2.3:o:linux:linux_kernel:2.6.12:rc2:*:*:*:*:*:*
    • cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:*:*:*:*:*:*
    • cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:*:*:*:*:*:*
    • cpe:2.3:o:linux:linux_kernel:2.6.12:rc5:*:*:*:*:*:*
    • (no CPE)

Patches

Vulnerability mechanics

References

10

News mentions

1