CVE-2026-93146: time/namespace: Validate nanosecond field in proc_timens_set_offset()
In the Linux kernel, the following vulnerability has been resolved:
time/namespace: Validate nanosecond field in proctimenssetoffset()
The function validates tvsec to be within [-KTIMESECMAX, KTIMESECMAX] but never validates that tvnsec is within the valid range of [0, NSECPERSEC-1] before using it in timespec64add().
timespec64add() expects both timespec64 structures to have normalized values with tvnsec in the range [0, 999999999]. If off->val.tvnsec contains invalid values (negative or >= NSECPERSEC), it could lead to incorrect calculations or unexpected behavior.
Add validation to ensure tvnsec is within the valid range before performing the addition.
Affected Software
Event History
Frequently Asked Questions
What input is required to trigger the issue?
An invalid nanosecond value in the time-namespace offset is required. Specifically, the tv_nsec field must be negative or greater than or equal to NSEC_PER_SEC (1,000,000,000) before it is used by timespec64_add().
How can I determine whether a system is affected?
Review whether the kernel includes the fix that validates tv_nsec in proc_timens_set_offset() before calling timespec64_add(). Affected code validates tv_sec but does not reject tv_nsec values outside 0 through 999,999,999.
What is the impact of supplying an invalid nanosecond value?
The invalid value can be passed to timespec64_add(), which expects normalized timespec64 values. This can cause incorrect time calculations or unexpected behavior.