In the Linux kernel

CVE-2026-64560 is a use-after-free in the Linux kernel's POSIX CPU timer subsystem, present since kernel 5.7 (and partially masked since ~2010). When a non-leader thread calls exec() while sys_timer_delete() is running concurrently, the old thread-group leader's task struct can be freed while sys_timer_delete() still holds a stale pointer. Subsequent run_posix_cpu_timers() or timerqueue add/delete operations then walk a dangling timerqueue_node, giving an attacker a kernel-heap UAF primitive — read, write, and control-flow hijack. The bug was independently discovered by Wongi Lee and Jungwoo Lee. Affected versions span 5.7 through mainline, and fixes landed in six LTS branches (5.10.262, 5.15.213, 6.1.180, 6.6.147, 6.12.100, 6.18.41) plus 7.1.5 and 7.2-rc3.

The vendor score of 7.8 HIGH is fair and we leave it essentially unchanged. The AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H vector accurately captures the threat: any unprivileged local user on a multi-threaded system can trigger the race with CPU pinning, and the impact is full CIA compromise of the host kernel. There is no remote vector and no evidence of in-the-wild exploitation yet, which prevents an upgrade to CRITICAL — but the kernel is the ultimate high-value component on every Linux host, so friction alone cannot pull this below HIGH.

Why this verdict

• Local-only attack vector — requires a pre-existing foothold (SSH, container shell, compromised service). This is a post-access primitive, not an initial-access vector, which applies moderate downward pressure from the 7.8 baseline.
• Low complexity, low privilege — the attacker controls both sides of the race via CPU pinning and needs only an unprivileged account. No exotic conditions required. This resists further downgrade.
• Role multiplier: kernel = universal high-value target — the Linux kernel runs on every Linux host. On KVM hypervisors, Kubernetes worker nodes, and CI/CD runners (collectively ≥10% of Linux installs), local-to-root means host compromise → fleet-scale blast radius. The chain succeeds in these roles (no additional prerequisites beyond local shell), setting a hard floor at HIGH.
• No in-the-wild exploitation or KEV listing — EPSS at 0.0012 and no public weaponized PoC for this specific CVE prevent an upgrade to CRITICAL.
• Broad affected window — kernels from 5.7 (2020) through July 2026 are vulnerable, meaning most enterprise fleets have vulnerable hosts unless they track stable branches closely.

Why not higher?

No confirmed in-the-wild exploitation, no CISA KEV listing, and EPSS is at the 12th percentile. The attack is local-only with no remote vector, meaning it cannot serve as initial access. A related POSIX timer PoC exists but no weaponized exploit for this specific CVE has been published. Without active exploitation evidence or a remote chain, CRITICAL is not justified.

Why not lower?

The Linux kernel is the canonical high-value-role component — it IS the hypervisor (KVM), the container host, the database tier OS. Local-to-root on these systems is fleet-compromise-scale. The race is described as low-complexity with attacker-controlled timing, and the 6-year affected window means broad exposure across enterprise fleets. Friction (local access requirement) sets the score within HIGH but cannot breach the HIGH floor given the role multiplier.

1. Apply kernel updates from your distro's security errata immediately — The upstream fix landed 2026-07-29 across all LTS branches. RHEL, Ubuntu, SUSE, and Debian have or will backport. This is the only complete remediation. Per noisgate HIGH remediation SLA, patch within 180 days; aim for 30 days given the breadth of the affected window.
2. Restrict POSIX timer syscalls via seccomp on containerized workloads — Add timer_create, timer_delete, and timer_settime to your seccomp deny-list for containers that don't need POSIX timers. This blocks the trigger entirely in container-escape scenarios. Deploy within 30 days per noisgate mitigation SLA.
3. Enable KASAN on staging/canary kernels — CONFIG_KASAN=y detects the UAF at trigger time and halts execution before exploitation completes. Not suitable for production performance workloads but useful for detecting exploitation attempts in pre-prod or canary rings.
4. Enforce SELinux/AppArmor in enforcing mode on high-value hosts — Even if the attacker achieves root via this UAF, mandatory access controls constrain lateral movement and data access. Ensure hypervisors, container hosts, and database servers run enforcing profiles. Deploy within 30 days.
5. Audit and limit local shell access on tier-0 infrastructure — The attack requires a local unprivileged shell. Reduce the population of users with interactive access to hypervisors, Kubernetes nodes, and database hosts. Use jump boxes with MFA and session recording.

Run this script on each target Linux host as any user (no root required). It checks the running kernel version against known-fixed versions. Invoke with: bash check_cve_2026_64560.sh

#!/usr/bin/env bash
# check_cve_2026_64560.sh — Detect CVE-2026-64560 (POSIX CPU timer UAF)
# Run on target host, no privileges required.
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN

set -euo pipefail

KERNEL=$(uname -r)
echo "[*] Running kernel: $KERNEL"

# Extract major.minor.patch
BASE=$(echo "$KERNEL" | grep -oP '^[0-9]+\.[0-9]+\.[0-9]+')
MAJOR=$(echo "$BASE" | cut -d. -f1)
MINOR=$(echo "$BASE" | cut -d. -f2)
PATCH=$(echo "$BASE" | cut -d. -f3)

if [ -z "$MAJOR" ] || [ -z "$MINOR" ] || [ -z "$PATCH" ]; then
  echo "UNKNOWN — could not parse kernel version"
  exit 2
fi

# Fixed versions per branch:
#   5.10.262, 5.15.213, 6.1.180, 6.6.147, 6.12.100, 6.18.41, 7.1.5, 7.2+
# Affected: 5.7 <= kernel < fixed

vulnerable() { echo "VULNERABLE — kernel $KERNEL is affected by CVE-2026-64560"; exit 1; }
patched()     { echo "PATCHED — kernel $KERNEL includes the fix"; exit 0; }

# Kernels before 5.7 are not affected
if [ "$MAJOR" -lt 5 ]; then patched; fi
if [ "$MAJOR" -eq 5 ] && [ "$MINOR" -lt 7 ]; then patched; fi

# 7.2+ is patched (fix in 7.2-rc3)
if [ "$MAJOR" -gt 7 ]; then patched; fi
if [ "$MAJOR" -eq 7 ] && [ "$MINOR" -ge 2 ]; then patched; fi

# Branch checks
if [ "$MAJOR" -eq 5 ]; then
  if [ "$MINOR" -ge 7 ] && [ "$MINOR" -lt 10 ]; then
    # 5.7-5.9: no LTS fix backported to these EOL branches
    vulnerable
  elif [ "$MINOR" -eq 10 ]; then
    [ "$PATCH" -ge 262 ] && patched || vulnerable
  elif [ "$MINOR" -gt 10 ] && [ "$MINOR" -lt 15 ]; then
    vulnerable
  elif [ "$MINOR" -eq 15 ]; then
    [ "$PATCH" -ge 213 ] && patched || vulnerable
  else
    vulnerable
  fi
elif [ "$MAJOR" -eq 6 ]; then
  if [ "$MINOR" -lt 1 ]; then
    vulnerable
  elif [ "$MINOR" -eq 1 ]; then
    [ "$PATCH" -ge 180 ] && patched || vulnerable
  elif [ "$MINOR" -gt 1 ] && [ "$MINOR" -lt 6 ]; then
    vulnerable
  elif [ "$MINOR" -eq 6 ]; then
    [ "$PATCH" -ge 147 ] && patched || vulnerable
  elif [ "$MINOR" -gt 6 ] && [ "$MINOR" -lt 12 ]; then
    vulnerable
  elif [ "$MINOR" -eq 12 ]; then
    [ "$PATCH" -ge 100 ] && patched || vulnerable
  elif [ "$MINOR" -gt 12 ] && [ "$MINOR" -lt 18 ]; then
    vulnerable
  elif [ "$MINOR" -eq 18 ]; then
    [ "$PATCH" -ge 41 ] && patched || vulnerable
  else
    patched
  fi
elif [ "$MAJOR" -eq 7 ]; then
  if [ "$MINOR" -eq 0 ]; then
    vulnerable
  elif [ "$MINOR" -eq 1 ]; then
    [ "$PATCH" -ge 5 ] && patched || vulnerable
  fi
fi

echo "UNKNOWN — kernel version $KERNEL did not match any known branch"
exit 2

Sources

1. Linux Kernel LTS Release Announcement (LinuxCompatible)
2. CVE-2026-64560 Detail (THREATINT)
3. GBHackers — PoC for POSIX CPU Timer UAF Class
4. CybersecurityNews — POSIX CPU Timer UAF Analysis
5. LWN.net — Linux 6.18.41 Release
6. Warp2Search — LTS Kernel Fix Coverage
7. linux-cve-announce Mailing List