CVE-2026-89765: timers/itimer: Zero-init old itimerval before copy to userspace
In the Linux kernel, the following vulnerability has been resolved:
timers/itimer: Zero-init old itimerval before copy to userspace
On native sparc64, struct kerneloldtimeval contains a four-byte hole after tvusec because tvsec is 64-bit while kernelsusecondst is 32-bit. putitimerval() fills only the named fields in a stack-allocated kernelolditimerval and copies the entire object to userspace, so getitimer() can expose the two padding holes.
Zero-initialize the aggregate before assigning the fields so implicit padding is deterministic before it crosses the user/kernel boundary.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this information leak?
The issue affects native sparc64 systems because the legacy timeval structure has padding holes on that architecture. The described exposure occurs when getitimer() copies the legacy itimerval structure from the kernel to userspace.
What does an attacker need to do to trigger the leak?
A local userspace process needs to invoke getitimer() and receive the old itimerval structure. The vulnerability does not describe any network-access requirement or need for elevated privileges.
Are default configurations affected?
The issue is in the kernel's handling of getitimer() on native sparc64 and does not depend on an optional feature or non-default configuration in the provided information.
What is exposed by the vulnerability?
The kernel may copy uninitialized stack bytes contained in two structure-padding holes to userspace. The provided information does not identify the contents or amount of sensitive data that may be present in those bytes.