-

CVE-2026-89765

timers/itimer: Zero-init old itimerval before copy to userspace

In the Linux kernel, the following vulnerability has been resolved:

timers/itimer: Zero-init old itimerval before copy to userspace

On native sparc64, struct __kernel_old_timeval contains a four-byte hole
after tv_usec because tv_sec is 64-bit while __kernel_suseconds_t is 32-bit.
put_itimerval() fills only the named fields in a stack-allocated
__kernel_old_itimerval and copies the entire object to userspace, so
getitimer() can expose the two padding holes.

Zero-initialize the aggregate before assigning the fields so implicit
padding is deterministic before it crosses the user/kernel boundary.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version < 6d4b937251386d9c6f968e7802f0cb16a8523772
Status affected
Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version < 4ea70146ab9376092297eb8b622ef1792797f2cf
Status affected
Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version < a17b345daff46fec4af9f1ecbdf350208016dd15
Status affected
Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version < bdfda99c5763822a9a888e8af0ad7d9312ffcfe2
Status affected
Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version < 4c66719dd1e4023c5e3f7d050f1bbefec3dfbeb4
Status affected
Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version < 2bf5e8f7c9bf4ad3be343a9a6e3e50a34264d25e
Status affected
Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version < 00ef529a5402f41eb1d227916437e237450719f9
Status affected
Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Version < 18c7d85864e554adc8fad1e8d2e9d2cb6c3911c8
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 2.6.12
Status affected
Version 0
Version < 2.6.12
Status unaffected
Version <= 5.10.*
Version 5.10.270
Status unaffected
Version <= 5.15.*
Version 5.15.221
Status unaffected
Version <= 6.1.*
Version 6.1.188
Status unaffected
Version <= 6.6.*
Version 6.6.157
Status unaffected
Version <= 6.12.*
Version 6.12.109
Status unaffected
Version <= 6.18.*
Version 6.18.50
Status unaffected
Version <= 7.2.*
Version 7.2.4
Status unaffected
Version <= *
Version 7.3-rc1
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.19% 0.084
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/4c66719dd1e4023c5e3f7d050f1bbefec3dfbeb4
https://git.kernel.org/stable/c/2bf5e8f7c9bf4ad3be343a9a6e3e50a34264d25e
https://git.kernel.org/stable/c/00ef529a5402f41eb1d227916437e237450719f9
https://git.kernel.org/stable/c/18c7d85864e554adc8fad1e8d2e9d2cb6c3911c8
https://git.kernel.org/stable/c/4ea70146ab9376092297eb8b622ef1792797f2cf
https://git.kernel.org/stable/c/6d4b937251386d9c6f968e7802f0cb16a8523772
https://git.kernel.org/stable/c/a17b345daff46fec4af9f1ecbdf350208016dd15
https://git.kernel.org/stable/c/bdfda99c5763822a9a888e8af0ad7d9312ffcfe2