A newly disclosed use-after-free flaw in the Linux kernel’s CPU timer subsystem allows local users to escalate privileges to root, with exploit code already public. The vulnerability, tracked as CVE-2026-64560, carries a CVSS score of 7.8 and was detailed in a security advisory published by SecurityOnline. The flaw exists in the handling of CPU timers when they are removed while an exec() system call runs in a non-leader thread.
This race condition leaves a dangling pointer that can be reused to inject attacker‑controlled data into kernel memory. Successful exploitation grants the attacker full root access on the affected machine.
The root cause lies in the timer deletion routine, which fails to synchronize properly with the exec() path for thread group leaders. When a timer is queued for deletion, the code clears a reference without waiting for ongoing exec() operations to finish. If an exec() call occurs concurrently, the reference may be freed while still in use, leading to a use-after-free condition. By manipulating the timing of these operations, an attacker can cause the kernel to dereference the freed memory with attacker‑supplied content. This makes it possible to overwrite function pointers or other critical kernel structures.
NebuSec researchers crafted a proof‑of‑concept that repeatedly spawns child processes calling exec() while simultaneously triggering timer deletions through the timerfd interface. The exploit sprays the kernel heap with crafted objects to increase the likelihood of hitting the freed region. When the use-after-free occurs, the attacker‑controlled payload overwrites a function pointer in the kernel’s signal handling routine. Subsequent signal delivery then executes the payload with kernel privileges, effectively giving the attacker root. The exploit was made public in their GitHub repository here.
Although no instances of active exploitation have been observed in the wild, the public release of a working proof‑of‑concept raises the probability that attackers will integrate the flaw into malware or post‑exploitation toolkits. The vulnerability was also mentioned in the Tails 7.10.1 release note, which warned that the flaw could undermine user anonymity on live systems. Tails users are advised to upgrade to the latest version that includes the patched kernel.
The disclosure highlights how a seemingly minor race condition can have far‑reaching consequences for system security. Administrators should treat the issue as urgent despite the absence of in‑the‑wild sightings.
Defenders should apply the latest kernel updates from their distribution vendors as soon as possible, since those packages contain the specific fix for CVE-2026-64560. Many major distros have already released patched kernels labeled with versions 5.15.140, 6.1.70 or 6.6.30 depending on the release line. Systems that cannot be rebooted immediately should consider temporarily restricting local interactive logins to trusted administrators only.
Disabling access to the timerfd interface for untrusted users can also reduce the attack surface while patches are being applied. Finally, ensuring that only signed kernel modules are loaded helps prevent abuse of the compromised memory region.
In addition to patching, monitoring for abnormal patterns of timer deletion and exec() syscalls can provide early warning of an attempted exploit. Administrators can enable audit rules that flag frequent timerfd_close or timerfd_settime calls combined with rapid exec() bursts from the same user session. Reviewing audit logs for unexpected uid changes from non‑privileged accounts to root is also recommended.
If possible, enabling the kernel’s lockdown feature or restricting the use of ptrace can limit an attacker’s ability to manipulate kernel memory even if the race condition is triggered. These detective and preventive controls complement the primary patching strategy.
While the vulnerability requires local access, chaining it with other flaws such as a vulnerable SUID binary or a misconfigured container escape could enable remote compromise, so maintaining a layered defence strategy remains essential. Keeping kernels up to date and limiting unnecessary local privileges are the most effective mitigations at this time. Organizations that rely on long‑term support kernels should prioritize backporting the fix or upgrading to a supported release line.
Regularly reviewing kernel changelogs for security fixes helps ensure that similar race conditions are not overlooked in the future. Staying vigilant and applying updates promptly is the best defence against this and related threats.