Linux Kernel: itimerval Padding Leak via getitimer()
CVE-2026-89765 Published on September 11, 2026
timers/itimer: Zero-init old itimerval before copy to userspace
In the Linux kernel, the following vulnerability has been resolved:
timers/itimer: Zero-init old itimerval before copy to userspace
On native sparc64, struct __kernel_old_timeval contains a four-byte hole
after tv_usec because tv_sec is 64-bit while __kernel_suseconds_t is 32-bit.
put_itimerval() fills only the named fields in a stack-allocated
__kernel_old_itimerval and copies the entire object to userspace, so
getitimer() can expose the two padding holes.
Zero-initialize the aggregate before assigning the fields so implicit
padding is deterministic before it crosses the user/kernel boundary.
Products Associated with CVE-2026-89765
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and below 4c66719dd1e4023c5e3f7d050f1bbefec3dfbeb4 is affected.
- Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and below 2bf5e8f7c9bf4ad3be343a9a6e3e50a34264d25e is affected.
- Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and below 00ef529a5402f41eb1d227916437e237450719f9 is affected.
- Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and below 18c7d85864e554adc8fad1e8d2e9d2cb6c3911c8 is affected.
- Before 6.12.109 is affected.
- Before 6.18.50 is affected.
- Before 7.2.4 is affected.
- Version 6.12.109, <= 6.12.* is unaffected.
- Version 6.18.50, <= 6.18.* is unaffected.
- Version 7.2.4, <= 7.2.* is unaffected.
- Version 7.3-rc1, <= * is unaffected.