Loading vulnerability…
A use-after-free vulnerability in the Linux kernel posix CPU timers subsystem arises from a race between timer deletion or timer setup paths and a non-leader exec() that changes the thread-group leader. In the affected logic, timer operations can resolve a task reference based on the old leader, then observe the task's signal-handling state as cleared during leader switch and exit processing, causing the operation to return without properly synchronizing with timer inheritance and cleanup. If a thread-group-targeted POSIX CPU timer is armed and enqueued, exec()-time inheritance can leave timerqueue state reachable after the underlying POSIX timer object has been freed. Subsequent timer expiration handling or timerqueue add/delete activity can then dereference the freed timerqueue node, resulting in a kernel use-after-free. Related effects described for the same race include failure to rearm timers and a similar unsafe condition in the CPU nanosleep path. The upstream fix adds stronger memory-ordering semantics around signal-handling teardown and changes task lookup and sighand locking so that a transient NULL sighand during leader transition causes retry rather than premature success or silent return.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a small, focused proof-of-concept for CVE-2026-64560, a Linux kernel use-after-free race in posix CPU timers caused by non-leader exec() interacting with timer deletion/set/rearm paths. The repo contains 5 files: a detailed README, the upstream kernel fix patch, and a poc/ directory with one C source file plus Linux/Android build files. The main executable logic is in poc/cve_2026_64560_poc.c. The PoC is a local race trigger, not a full privilege-escalation exploit. Its core capability is to stress the vulnerable kernel path by running two concurrent activities: (1) timer threads repeatedly create, arm, briefly exercise, and delete CLOCK_PROCESS_CPUTIME_ID timers; and (2) exec threads repeatedly fork child processes where a non-leader pthread calls execve() on /bin/true (Linux) or /system/bin/true (Android). This is specifically designed to hit the window where pid_task() resolves the old thread-group leader while its sighand has just been cleared during de_thread()/__exit_signal(), causing the timer object to be freed while still queued in the process CPU timer rbtree. If the race lands on an unpatched kernel, subsequent timerqueue operations or run_posix_cpu_timers() may dereference the freed k_itimer, producing KASAN use-after-free reports, warnings, panic, or instability. The code includes a --check mode that verifies basic prerequisites by creating a CLOCK_PROCESS_CPUTIME_ID timer, checking the exec target path, and reading /proc/version. There is no network communication, no command-and-control behavior, and no payload for code execution or persistence. The included patch file documents the upstream fix strategy, including timer_lock_sighand() and memory-ordering changes in __exit_signal()/lock_task_sighand().
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.