CVE-2026-64560General

HIGHCVSS 7.8 · HIGH

Exploitation observed; activity peaked at 4 mentions and remains active

Immediate actions

Patch affected systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by non-leader exec() race Wongi and Jungwoo decoded and reported a non-leader exec() related race which can result in an UAF: sys_timer_delete() exec() posix_cpu_timer_del() // Observes old leader p = pid_task(pid, pid_type); de_thread() switch_leader(); release_task(old_leader) __exit_signal(old_leader) sighand = lock(old_leader, sighand); posix_cpu_timers*_exit(); sighand = lock_task_sighand(p) unhash_task(old_leader); sh = lock(p, sighand) old_leader->sighand = NULL; unlock(sighand); (p->sighand == NULL) unlock(sh) return NULL; // Returns without action if(!sighand) return 0; free_posix_timer(); This is "harmless" unless the deleted timer was armed and enqueued in p->signal because on exec() a TGID targeted timer is inherited. As sys_timer_delete() freed the underlying posix timer object run_posix_cpu_timers() or any timerqueue related add/delete operations on other timers will access the freed object's timerqueue node, which results in an UAF. There is a similar problem vs. posix_cpu_timer_set(). For regular posix timers it just transiently returns -ESRCH to user space, but for the use case in do_cpu_nanosleep() it's the same UAF just that the k_itimer is allocated on the stack. Also posix_cpu_timer_rearm() fails to rearm the timer, which means it stops to expire. While debating solutions Frederic pointed out another problem: posix_cpu_timer_del(tmr) __exit_signal(p) posix_cpu_timers*_exit(p); unhash_task(p); p->sighand = NULL; sh = lock_task_sighand(p) sighand = p->sighand; if (!sighand) return NULL; lock(sighand); if (!sh) WARN_ON_ONCE(timer_queued(tmr)); On weakly ordered architectures it is not guaranteed that posix_cpu_timer_del() will observe the stores in posix_cpu_timers*_exit() when p->sighand is observed as NULL, which means the WARN() can be a false positive. Solve these issues by: 1) Changing the store in __exit_signal() to smp_store_release(). 2) Adding a smp_acquire__after_ctrl_dep() into the !sighand path of lock_task_sighand(). 3) Creating a helper function for looking up the task and locking sighand which does not return when sighand == NULL. Instead it retries the task lookup and only if that fails it gives up. 4) Using that helper in the three affected functions. #1/#2 ensures that the reader side which observes sighand == NULL also observes all preceeding stores, i.e. the stores in posix_cpu_timers*_exit() and the ones in unhash_task(). #3 ensures that the above described non-leader exec() situation is handled gracefully. When the task lookup returns the old leader, but sighand == NULL then it retries. In the non-leader exec() case the subsequent task lookup will observe the new leader due to #1/#2. In normal exit() scenarios the subsequent lookup fails. When the task lookup fails, the function also checks whether the timer is still enqueued and issues a warning if that's the case. Unfortunately there is nothing which can be done about it, but as the task is already not longer visible the timer should not be accessed anymore. This check also requires memory ordering, which is not provided when the first lookup fails. To achieve that the check is preceeded by a smp_rmb() which pairs with the smp_wmb() in write_seqlock() in __exit_signal(). That ensures that the stores in posix_cpu_timers*_exit() are visible. The history of the non-leader exec() issue goes back to the early days of posix CPU timers, which stored a pointer to the group leader task in the timer. That obviously fails when a non-leader exec() switches the leader. commit e0a70217107e ("posix-cpu-timers: workaround to suppress the problems with mt exec") added a temporary workaround for that in 2010 which surv ---truncated---

Back to dashboard

7.8/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-362

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Active exploitation appears in 2 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
20 mentions across 13 observed days

What's happening

Active exploitation reported across 2 signals
Exploit tool or code specified in 4 signals
PoC mentioned or linked in 8 signals
Patch or workaround mentioned in 6 signals
Technical details provided in 11 signals
General: 5 classified signals
Disclosure: 4 classified signals
Peaked 9d ago at 4 mentions (2026-08-03); latest day: 1
20 total mentions across 13 days

Deep dive

Activity timeline20 mentions / 13d

Signal classification6 categories

General

525.0%

Patch

420.0%

Disclosure

420.0%

PoC

420.0%

Exploit

210.0%

Active Exploitation

15.0%

Referenced assets26 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-29	2	General1Patch1
2026-07-30	2	Active Exploitation1Disclosure1
2026-08-02	2	General1PoC1
2026-08-03	4	Exploit2PoC2
2026-08-05	1	Patch1
2026-08-06	1	Patch1
2026-08-07	1	Patch1
2026-08-09	1	Disclosure1
2026-08-12	2	General1PoC1
2026-08-28	1	General1
2026-09-12	1	General1
2026-09-15	1	Disclosure1
2026-10-06	1	Disclosure1

Full discourse20 posts

Zero Day Engineering@zerodayalpha87d
PoC
⚡️ Linux Kernel just issued a single-fix security update for stable LTS branches, addressing CVE-2026-64560. We were able to exploit the bug and independently confirm that it's serious. The impact is kernel code execution and EoP from unpriveleged user with no CAPs/userns, io_uring disable + BPF JIT hardening. The use-after-free primitive is reliable despite the race (<1m to exploit). No wild attacks were seen yet. They are likely, given our technical picture. Majority of Android devices are affected. Exploitability on Android wasn't empirically confirmed yet.
Post summary
Researchers demonstrated a serious use‑after‑free in the Linux kernel (CVE‑2026‑64560) and confirmed it can lead to code execution, while a vendor patch has already been released and no active exploitation has been observed.
5181137639.8K
11.8K followersView on X
Frank Wu@FrankOverF1ow86d
PoC
@zerodayalpha @alisaesage Android exploit with CVE-2026-64560: https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Ndays/Android-CVE-2026-64560
Post summary
The tweet indicates a Proof of Concept for CVE-2026-64560 is available on GitHub, highlighting an Android exploit.
211077403.1K
1.9K followersView on X
Nebula Security@nebusecurity86d
Exploit
We've also open-sourced two more LPE exploits for the latest Android on CyberMeowfia, Have fun! CVE-2026-43074: https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Ndays/Android-CVE-2026-43074 CVE-2026-64560: https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Ndays/Android-CVE-2026-64560 And we'll be giving two talks at Black Hat USA 2026 this week, come say hi in Vegas!
Post summary
The authors have open‑sourced functional LPE exploits for CVE-2026-43074 and CVE-2026-64560 on GitHub, announcing talks at Black Hat 2026, but there is no indication of current exploitation, patches, or misinformation.
16142194.1K
7.2K followersView on X
Brad Spengler@spendergrsec91d
Disclosure
https://lore.kernel.org/linux-cve-announce/2026072908-CVE-2026-64560-3932@gregkh/T/#u https://t.co/0780XezBJt
Post summary
The tweet simply links to a kernel.org announcement for CVE-2026-64560, providing no further detail.
131271921.4K
7.1K followersView on X
hackyboiz@hackyboiz223d
Disclosure
[1day1line] CVE-2026-64560: Use-after-free in Linux Kernel POSIX CPU timers caused by a race with non-leader execve() Today's 1day1line covers a use-after-free vulnerability in the Linux Kernel POSIX CPU timer implementation. When a non-leader thread calls execve(), the thread-group leader can change while another CPU is deleting a process CPU timer. This race can leave a timerqueue node referencing a freed k_itimer, resulting in a UAF. Please refer to the blog post for details! https://hackyboiz.github.io/2026/10/03/poosic/cve-2026-64560/
Post summary
The post announces a use-after-free vulnerability in the Linux Kernel POSIX CPU timer implementation, providing technical details about the race condition and a link to a blog post for further information.
03029101.4K
583 followersView on X
od8m@od8m_61d
General
CVE-2026-64560 https://t.co/yEDHybtBdr
Post summary
The tweet merely references CVE-2026-64560 and includes a URL, with no further information.
1002301.0K
63 followersView on X
Daily CyberSecurity@Daily_CyberSec83d
Patch
Tails 7.10.1 patches CVE-2026-64560 in the Linux kernel and expat library flaws that could let attackers deanonymize users and gain admin privileges. #Tails #Linux #Privacy #CVE202664560 #Cybersecurity #AnonymousOS http://securityonline.info/tails-7-10-1-linux-kernel-vulnerability/
Post summary
Tails 7.10.1 releases a patch for CVE‑2026‑64560, fixing kernel and expat library vulnerabilities that could otherwise allow attackers to deanonymize users and elevate privileges.
45093733
13.0K followersView on X
Daily CyberSecurity@Daily_CyberSec78d
PoC
PoC exploit code is public for CVE-2026-64560, a Linux kernel CPU timer flaw that gives a root shell on Pixel 10 Pro. CVSS 7.0. Details inside. #Linux #Android #Pixel #CVE #CyberSecurity http://securityonline.info/linux-kernel-cpu-timer-flaw/
Post summary
The post announces that PoC exploit code for CVE-2026-64560 is publicly available, providing a root shell on Pixel 10 Pro, but no detailed exploit or active attack evidence is given.
03093780
13.0K followersView on X
dbugs@ptdbugs87d
Exploit
A PoC/exploit has been discovered for vulnerability CVE-2026-64560 PT ID: PT-2026-65857 Vendor: Linux Product: Linux (Andriod Kernel) Description: A use-after-free (UAF) issue exists in the posix-cpu-timers subsystem of the Linux kernel. The problem occurs during a race condition involving a non-leader exec() call, where a task lookup may return an old leader that is subsequently released. This can lead to the free posix timer() function freeing a timer object that is still enqueued in the signal queue. Consequently, subsequent operations such as run posix cpu timers() or other timer queue modifications may access the freed memory. Similar issues affect posix cpu timer set() and posix cpu timer rearm(), the latter of which may fail to rearm the timer, causing it to stop expiring. Additionally, on weakly ordered architectures, a lack of proper memory ordering in posix cpu timer del() could lead to false positive warnings during task exit. References: • https://dbugs.ptsecurity.com/vulnerability/PT-2026-65857 • https://github.com/NebuSec/CyberMeowfia/blob/main/security-research/Ndays/Android-CVE-2026-64560/exploit.c #dbugs_vuln
Post summary
A PoC and functional exploit for CVE‑2026‑64560 have been disclosed, highlighting a use‑after‑free race condition in the Linux kernel’s posix‑cpu‑timers subsystem.
100911.2K
3.6K followersView on X
Mr. OS@ksg93rd47d
General
#Analytics #Threat_Research An analytical review of the main cybersecurity events (Sep 05-12, 2026) 1⃣ Sonicwall SMA1000 Attack https://hunt.io/blog/sonicwall-sma1000-uk-council-attack // CVE-2026-15409 2⃣ Cisco Secure Firewall Management Center Software Authentication Bypass Vulnerability https://hunt.io/blog/sonicwall-sma1000-uk-council-attack 3⃣ Next Nightmare Eclipse Vulnerability https://github.com/MSNightmare/ShieldCrash/blob/main/README.md // Microsoft has failed to properly patch ShieldBreak CVE-2026-69414.. 4⃣ FortiPAM Vulnerability https://amibeingpwned.com/blog/fortinet-pam-vuln // CVE-2026-84388 5⃣ Researchers from Nebula Security have disclosed 18 vulnerabilities in the Linux kernel https://www.openwall.com/lists/oss-security/2026/09/08/1 // CVE-2026-80714, CVE-2026-74597, CVE-2026-74581, CVE-2026-74480, CVE-2026-72255, CVE-2026-72137, CVE-2026-68376, CVE-2026-68162, CVE-2026-64560, CVE-2026-63834, CVE-2026-52933, CVE-2026-52929, CVE-2026-52924, CVE-2026-52923, CVE-2026-52912, CVE-2026-43501, CVE-2026-43502, CVE-2026-43074, CVE-2026-43042, CVE-2026-31678, CVE-2026-31659, CVE-2026-23274 6⃣ Netscaler ADC Exploit 7⃣ Critical vulnerabilities in MikroTik RouterOS https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/ 8⃣ GRAYRABBIT One-click backdoor // One click. Three critical failures. One backdoor https://www.gendigital.com/blog/insights/research/one-click-backdoor-sogou 9⃣ Attacks using browser-in-browser (BiTB) phishing techniques https://www.huntress.com/blog/phishing-bitb-rmm-attacks 🔟 Beltdown: Escaping the Claude Code sandbox https://www.accomplish.ai/blog/beltdown-escaping-the-claude-code-sandbox/ // An untrusted repository opened in Claude Code can escape the macOS sandbox and run commands on your computer as your privileged user http://www.Geniebot.pro http://www.cyberpocket.org
Post summary
A recap of cybersecurity events from Sep 05‑12 2026, including disclosed vulnerabilities, active exploitation reports, and links to technical details and potential PoC resources.
01052601
3.4K followersView on X
OS開発者@hacker_infra88d
General
CVE-2026-64560ぽい。 KASANを見るとクラッシュしているみたいだな。 https://access.redhat.com/security/cve/cve-2026-64560
Post summary
The note references CVE‑2026‑64560, hints at a kernel crash via KASAN, and links to a Red Hat page but provides no technical details, exploit code, or patch information.
01140759
2.9K followersView on X
roddux@roddux88d
PoC
@alisaesage Looks like a PoC for CVE-2026-64560 ?
Post summary
The tweet hints that a proof of concept for CVE-2026-64560 may exist, but provides no concrete details or evidence.
100301.1K
1.9K followersView on X
Threat Landscape@LandscapeThreat44d
Disclosure
Researchers disclosed CVE-2026-43502, a Linux kernel local privilege-escalation vulnerability in the RDS zerocopy send path, alongside 20 additional exploitable Linux bugs. - An unprivileged local user can obtain root privileges without Linux capabilities or user namespaces when required networking, asynchronous I/O, and RDS components are enabled. - The vulnerability affects kernels from Linux v4.17 and was demonstrated on openSUSE with kernel 6.4.0-150600.23.100. - The issue was fixed by commit 44b550d88b26, first included in Linux v7.1-rc3; public exploits for the listed vulnerabilities are available. VULNERABILITY CVE-2026-23274 CVE-2026-31659 CVE-2026-31678 CVE-2026-43042 CVE-2026-43074 CVE-2026-43501 CVE-2026-43502 CVE-2026-52912 CVE-2026-52923 CVE-2026-52924 CVE-2026-52929 CVE-2026-52933 CVE-2026-63834 CVE-2026-64560 CVE-2026-68162 CVE-2026-68376 CVE-2026-72137 CVE-2026-72255 CVE-2026-74480 CVE-2026-74581 CVE-2026-74597 CVE-2026-80714
Post summary
Text announces CVE-2026-43502 and 20 additional Linux kernel local privilege-escalation vulnerabilities with technical details, notes public exploits are available, and mentions the fix in Linux v7.1-rc3.
0002055
123 followersView on X
moton@moton78d
General
CVE-2026-64560: Linux Kernel Bug Gives Root Shell - https://securityonline.info/linux-kernel-cpu-timer-flaw/
Post summary
The text references CVE-2026-64560 as a Linux kernel flaw that can provide a root shell but offers no additional technical details, PoC, or mitigation information.
0000178
748 followersView on X
ThreatCluster@threatcluster84d
Patch
Tails Linux patched a critical kernel flaw (CVE-2026-64560) affecting versions since Linux 5.7 that allows malicious websites to deanonymise users by gaining administrator privileges through the Tor Browser. https://t.co/oIYEEM0wpd
Post summary
The tweet announces that Tails Linux has released a patch for CVE-2026-64560, a kernel flaw that could let malicious sites deanonymise users by gaining admin privileges through the Tor Browser.
10000116
436 followersView on X
CVE@CVEnew91d
Patch
CVE-2026-64560 In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by non-leader exec() race Wongi and Jungwoo decoded and rep… https://www.cve.org/CVERecord?id=CVE-2026-64560
Post summary
CVE-2026-64560, a Use‑After‑Free in the Linux kernel's posix‑cpu‑timers module, has been resolved by a patch. No PoC, exploit, or active exploitation is reported.
00001753
57.9K followersView on X
Windows Forum@windowsforum81d
Disclosure
🐧 CVE-2026-64560 isn’t a Windows kernel bug—it’s a Linux kernel race hiding in WSL 2. Check your Linux guests and hosts, because “Windows security alert” doesn’t always mean Windows is guilty. https://windowsforum.com/security-alerts.84/cve-2026-64560-check-wsl-2-and-linux-host-kernels.442126/?utm_source=x&utm_medium=social&utm_campaign=news_node84 #LinuxKernel #KernelSecurity #Wsl2 #Cve202664560 https://t.co/0ugETpmiWQ
Post summary
The post clarifies that CVE‑2026‑64560 is a Linux kernel race condition in WSL 2, not a Windows kernel vulnerability, and urges users to review their Linux guests and hosts.
0000071
1.3K followersView on X
CybSecWorld@CybSecWorld84d
Patch
Tails Linux Fixes Critical Flaw That Could Deanonymize Users https://cybsec.world/tails-linux-cve-2026-64560-emergency-patch/ https://t.co/fvJ8bhRzKt
Post summary
The article announces that Tails Linux has issued an emergency patch for CVE-2026-64560, a critical flaw that could deanonymize its users.
0000046
94 followersView on X
VulDB 🛡@vuldb90d
Active Exploitation
Our CTI team identified a lot of activities targeting Linux Kernel (CVE-2026-64560) https://vuldb.com/vuln/384220/cti
Post summary
CTI report notes widespread activity targeting Linux Kernel CVE‑2026‑64560, indicating active exploitation but lacking PoC, exploit tools, patches, or technical details.
00000148
2.3K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds91d
General
CVE-2026-64560 Use-After-Free in Linux Kernel Posix-CPU-Timers Non-Leader Exec R... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-64560 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4
Post summary
The post merely references CVE-2026-64560 with a short description and links pointing to external sites; it contains no actionable or detailed information about the vulnerability.
00000111
4.1K followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-64560

Frank Wu[verified]@FrankOverF1owPoC

The tweet indicates a Proof of Concept for CVE-2026-64560 is available on GitHub, highlighting an Android exploit.

Nebula Security[verified]@nebusecurityExploit

The authors have open‑sourced functional LPE exploits for CVE-2026-43074 and CVE-2026-64560 on GitHub, announcing talks at Black Hat 2026, but there is no indication of current exploitation, patches, or misinformation.

hackyboiz[verified]@hackyboiz2Disclosure

The post announces a use-after-free vulnerability in the Linux Kernel POSIX CPU timer implementation, providing technical details about the race condition and a link to a blog post for further information.

dbugs[verified]@ptdbugsExploit

A PoC and functional exploit for CVE‑2026‑64560 have been disclosed, highlighting a use‑after‑free race condition in the Linux kernel’s posix‑cpu‑timers subsystem.

OS開発者[verified]@hacker_infraGeneral

The note references CVE‑2026‑64560, hints at a kernel crash via KASAN, and links to a Red Hat page but provides no technical details, exploit code, or patch information.

Threat Landscape[verified]@LandscapeThreatDisclosure

Text announces CVE-2026-43502 and 20 additional Linux kernel local privilege-escalation vulnerabilities with technical details, notes public exploits are available, and mentions the fix in Linux v7.1-rc3.

ThreatCluster[verified]@threatclusterPatch

The tweet announces that Tails Linux has released a patch for CVE-2026-64560, a kernel flaw that could let malicious sites deanonymise users by gaining admin privileges through the Tor Browser.

Windows Forum[verified]@windowsforumDisclosure

The post clarifies that CVE‑2026‑64560 is a Linux kernel race condition in WSL 2, not a Windows kernel vulnerability, and urges users to review their Linux guests and hosts.