CVE-2026-64370
In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path In do_cpu_nanosleep(), posix_cpu_timer_create() takes a pid reference via get_pid() and stores it in timer.it.cpu.pid. If the subsequent posix_cpu_timer_set() call fails, the function returns immediately without calling posix_cpu_timer_del() to release the pid reference, causing a leak. Fix it by calling posix_cpu_timer_del() before the unlock-and-return on the error path, consistent with the other exit paths in the same function.
Affected versions
Linux kernel versions
2.6.12
and later are affected. Fixed in
5.10.261,
5.15.212,
6.1.178,
6.6.145,
6.12.96,
6.18.39,
7.1.4,
7.2-rc1
and their respective stable series.
References
8 totalFrequently asked questions
-
What is CVE-2026-64370?
CVE-2026-64370 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 2.6.12 onward and has been patched in 5.10.261, 5.15.212, 6.1.178 and others. CVE-2026-64370 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-64370?
Yes. CVE-2026-64370 has been patched. Fixed versions include 5.10.261, 5.15.212, 6.1.178 and others. If you are running Linux kernel 2.6.12 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-64370 actively exploited?
No. CVE-2026-64370 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.