CVE-2026-64560-Analysis

CVE-2026-64560 — Linux Kernel posix-cpu-timers non-leader exec 경쟁 조건 UAF Reproducer / PoC트리거 검증형 : Linux & Android NDK 본 저장소는 자체 테스트 기기 에서 패치 상태를 검증하고 연구/학습 목적으로만 제공되며, 권한 상승/익스플로잇 프리미티브를 포함하지 않습니다. 1. 취약점 개요 필드| 내용 ---|--- CVE ID| CVE-2026-64560 제목| posix-cpu-timers: Prevent UAF caused by...

cve-2026-64560-a16

CVE-2026-64560 — 도구 체인 + 다중 타깃 이식 CVE-2026-64560은 Linux 커널 posix-cpu-timers의 use-after-free입니다 로컬 비권한 레이스, CVSS 3.1 = 7.8; 6.6.118 미수정, 6.6.147에서야 수정. 이 저장소에는 두 가지가 있습니다: 업스트림에서 수많은 Python 스크립트로만 구동 가능한 도구 체인을 단일 정적 Go 바이너리 로 만드는 것, 그리고 업스트림에 없는 realme RMX5010 A16 / SM8750 타깃을 추가하는 것입니다. !WARNING...

Cronos

Cronos 이 프로젝트의 공동 저자 설명 대기 가능한 타이머waitable timer를 활용하여 현재 프로세스를 RC4로 암호화하고 권한을 RW에서 RX로 변경해 메모리 스캐너를 회피하는 새로운 슬립 난독화 기법의 PoC입니다. Ekko 기반 더 자세한 설명은 블로그 게시물에서 확인할 수 있습니다. 사용법 사용하려면 프로젝트에 Cronos를 포함하고 다음과 같이 사용하기만 하면 됩니다. include "Cronos.h" int main int timesToExecute = 1337; int seconds = 10; for i...

TickTock

TickTock 이 저장소는 Ekko Sleep Obfuscation에서 사용되는 타이머 큐 타이머Timer-Queue Timers를 열거하기 위한 PoC 메모리 스캐너를 시연합니다: https://github.com/Cracked5pider/Ekko. 전체 기술 분석은 함께 제공되는 블로그 게시물을 참조하세요: https://labs.withsecure.com/publications/hunting-for-timer-queue-timers.html. 아래 스크린샷은 Ekko 실행 중 타이머 큐 타이머를 스캔한 결과를 보여줍니다...

Exploit for CVE-2026-64560

Redmi 14C “pond” – CVE-2026-64560 Migration Kit Global Rele...

Rocky Linux 10.0 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc (crlsa-2025_15662)

The Rocky Linux 10.0 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202515662 advisory. kernel: posix-cpu-timers: fix race between handleposixcputimers and posixcputimerdel CVE-2025-38352 Tenable has extracted the preceding description block direct...

Rocky Linux 8 [CIQ] Security Update: bpftool / bpftool-debuginfo / kernel / kernel-abi-stablelists / etc Multiple Vulnerabilities (crlsa-2025_15471)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202515471 advisory. kernel: bpf: Don't use tnumrange on array range checking for poke descriptors CVE-2022-49985 kernel: posix-cpu-timers: fix race between handleposixcputime...

Exploit for CVE-2026-64560

CVE-2026-64560 – Toolchain + Multi-target Porting CVE-2026-64...

Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP5 kernel was updated to fix various security issues: The following security issues were fixed: CVE-2025-40277: drm/vmwgfx: Validate command header size against bsc1254894. CVE-2025-68214: timers: Fix NULL function pointer race in timershutdownsync bsc1255225...

K000163361: Linux kernel vulnerability CVE-2023-53781

Security Advisory Description In the Linux kernel, the following vulnerability has been resolved: smc: Fix use-after-free in tcpwritetimerhandler. With Eric's ref tracker, syzbot finally found a repro for use-after-free in tcpwritetimerhandler by kernel TCP sockets. 0 If SMC creates a kernel sock...

CVE-2026-90305: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ARM: 9483/1: select HAVEPOSIXCPUTIMERSTASKWORK Commit c6e61c06d606 "ARM: 9463/1: Allow to enable RT" enabled PREEMPTRT on ARM but did not select HAVEPOSIXCPUTIMERSTASKWORK. This leaves CONFIGPOSIXCPUTIMERSTASKWORK disabled, so CP...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15, and Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: posix-timers: Ensure that the limit on the timer ID search loop is valid. The posixtimeradd function attempts to allocate a posix timer ID by starting from the cached ID stored after the last successful allocation. This is done b...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: rtc: Check whether the rtcreadtime call was successful in rtctimerdowork. If the rtcreadtime call fails, the struct rtctime tm; structure may contain uninitialized data, or an illegal date/time reading from the RTC hardware may...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: bpf: Fixed a race condition between bpftimercancelandfree and bpftimercancel. This race condition could lead to a UAF Use-After-Free error involving the timer-timer variable. Here’s the detailed explanation: In bpftimer...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Clean up CPU timers before freeing them during exec. The commit 55e8c8eb2c7b “posix-cpu-timers: Store a reference to a pid instead of a task” introduced a mechanism to retrieve tasks by PID when deleting a CPU...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: posix-timers: A situation where livelock occurs in itimerdelete has been addressed. Itimerdelete includes a retry loop when the timer expires simultaneously. On non-RT kernels, this simply involves waiting until the timer callbac...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: AppArmor: Fixed the rlimit settings for posix cpu timers. posix cpu timers require an additional step beyond simply setting rlimit. The code should be refactored so it’s clear which code is setting the limits, and the posix cp...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: nfc: hci: shdlc: Stop timers and perform cleanup before freeing the context. The llcshdlcdeinit function cleans up SHDLC skb queues and frees the llcshdlc structure. During this process, timer functions and the state machine may...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: TCP: Timers for kernel sockets are properly terminated. We received various reports from syzbot that indicated that TCP timers would still fire even after the corresponding netns has been dismantled. Fortunately, Josef Bacik was...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

It was discovered that when executing from a non-leader thread, armed POSIX CPU timers would remain on a list but would then be freed, resulting in a use-after-free...