CVE-2026-93146: time/namespace: Validate nanosecond field in proc_timens_set_offset()
In the Linux kernel, the following vulnerability has been resolved:
time/namespace: Validate nanosecond field in proctimenssetoffset()
The function validates tvsec to be within [-KTIMESECMAX, KTIMESECMAX] but never validates that tvnsec is within the valid range of [0, NSECPERSEC-1] before using it in timespec64add().
timespec64add() expects both timespec64 structures to have normalized values with tvnsec in the range [0, 999999999]. If off->val.tvnsec contains invalid values (negative or >= NSECPERSEC), it could lead to incorrect calculations or unexpected behavior.
Add validation to ensure tvnsec is within the valid range before performing the addition.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.114 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.52 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.6 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.6-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.4-1 - Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.18~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1019.19~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.19~24.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.18~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1020.21 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1019.19 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1010.11 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-43.43.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In proc_timens_set_offset(), validate that tv_nsec is within [0, NSEC_PER_SEC-1] before passing the value to timespec64_add(); reject negative values or values >= NSEC_PER_SEC.
Event History
Frequently Asked Questions
What input is required to trigger the issue?
An invalid nanosecond value in the time-namespace offset is required. Specifically, the tv_nsec field must be negative or greater than or equal to NSEC_PER_SEC (1,000,000,000) before it is used by timespec64_add().
How can I determine whether a system is affected?
Review whether the kernel includes the fix that validates tv_nsec in proc_timens_set_offset() before calling timespec64_add(). Affected code validates tv_sec but does not reject tv_nsec values outside 0 through 999,999,999.
What is the impact of supplying an invalid nanosecond value?
The invalid value can be passed to timespec64_add(), which expects normalized timespec64 values. This can cause incorrect time calculations or unexpected behavior.