« Volver al listado

CVE-2026-72068

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

posix-cpu-timers: Use u64 multiplication in update_rlimit_cpu()

update_rlimit_cpu() converts the RLIMIT_CPU value to nanoseconds with

On 32-bit kernels both rlim_new (unsigned long) and NSEC_PER_SEC (1000000000L) are 32-bit, so the multiplication is performed in unsigned long and truncated for rlim_new > 4 seconds before being widened to u64.

The same file already casts to u64 for the matching computation in check_process_timers():

As a result, the truncated value is installed into the CPUCLOCK_PROF expiry cache (nextevt), causing the process CPU timer to be programmed to fire prematurely for any RLIMIT_CPU soft limit >= 5 seconds.

Leer descripción completaMostrar menos

The actual SIGXCPU/SIGKILL decision in check_process_timers() already casts to u64 and is therefore correct, so limit enforcement is not broken; only the expiry-cache programming is wrong. Apply the same cast here so both paths convert rlim_cur identically.

64-bit kernels are unaffected.

Detalles técnicos trazas, registros y código del informe original
        u64 nsecs = rlim_new * NSEC_PER_SEC;

        u64 softns = (u64)soft * NSEC_PER_SEC;

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-72068",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "858cf3a8c59968e7c5f7c1a1192459a0d52d1ab4",
              "lessThan": "feb5c87c8514444ba891b75a5a3eae57c64edaf8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "858cf3a8c59968e7c5f7c1a1192459a0d52d1ab4",
              "lessThan": "384628d6cdde0fcd76868606fad3ad8293100afb",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "858cf3a8c59968e7c5f7c1a1192459a0d52d1ab4",
              "lessThan": "1fafc4d9b411645eb34de43362b966dc8fb3e263",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "858cf3a8c59968e7c5f7c1a1192459a0d52d1ab4",
              "lessThan": "cff8281bacd2866767e6194c3079d33b6c5a74f4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "858cf3a8c59968e7c5f7c1a1192459a0d52d1ab4",
              "lessThan": "edf6babb9edd2d3e19229ade339081f439d4f478",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "858cf3a8c59968e7c5f7c1a1192459a0d52d1ab4",
              "lessThan": "ea6a188ee805e841a0e242f14d15953e0dfa74bb",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "858cf3a8c59968e7c5f7c1a1192459a0d52d1ab4",
              "lessThan": "571e1f10b5996ba3e4dc63ea77de4aa309c384ce",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "858cf3a8c59968e7c5f7c1a1192459a0d52d1ab4",
              "lessThan": "26aff38fefb1d6cd87e22525f41cc8f1aa61b24f",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "kernel/time/posix-cpu-timers.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.11"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "4.11",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "kernel/time/posix-cpu-timers.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-08-15T06:21:16.467",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/1fafc4d9b411645eb34de43362b966dc8fb3e263",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/26aff38fefb1d6cd87e22525f41cc8f1aa61b24f",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/384628d6cdde0fcd76868606fad3ad8293100afb",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/571e1f10b5996ba3e4dc63ea77de4aa309c384ce",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/cff8281bacd2866767e6194c3079d33b6c5a74f4",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/ea6a188ee805e841a0e242f14d15953e0dfa74bb",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/edf6babb9edd2d3e19229ade339081f439d4f478",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/feb5c87c8514444ba891b75a5a3eae57c64edaf8",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nposix-cpu-timers: Use u64 multiplication in update_rlimit_cpu()\n\nupdate_rlimit_cpu() converts the RLIMIT_CPU value to nanoseconds with\n\n        u64 nsecs = rlim_new * NSEC_PER_SEC;\n\nOn 32-bit kernels both rlim_new (unsigned long) and NSEC_PER_SEC\n(1000000000L) are 32-bit, so the multiplication is performed in unsigned\nlong and truncated for rlim_new > 4 seconds before being widened to u64.\n\nThe same file already casts to u64 for the matching computation in\ncheck_process_timers():\n\n        u64 softns = (u64)soft * NSEC_PER_SEC;\n\nAs a result, the truncated value is installed into the CPUCLOCK_PROF\nexpiry cache (nextevt), causing the process CPU timer to be programmed\nto fire prematurely for any RLIMIT_CPU soft limit >= 5 seconds. The\nactual SIGXCPU/SIGKILL decision in check_process_timers() already casts\nto u64 and is therefore correct, so limit enforcement is not broken;\nonly the expiry-cache programming is wrong. Apply the same cast here so\nboth paths convert rlim_cur identically.\n\n64-bit kernels are unaffected."
    }
  ],
  "lastModified": "2026-08-17T06:18:05.303",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}