Search

CVE-2026-89765 - timers/itimer: Zero-init old itimerval before copy to userspace

CVE ID : CVE-2026-89765 Published : Sept. 11, 2026, 8:20 p. m. • 32 minutes ago Description : In the Linux kernel, the following vulnerability has been resolved: timers/itimer: Zero-init old itimerval before copy to userspace On native sparc64, struct __kernel_old_timeval contains a four-byte hole after tv_usec because tv_sec is 64-bit while __kernel_suseconds_t is 32-bit. put_itimerval() fills only the named fields in a stack-allocated __kernel_old_itimerval and copies the entire object to userspace, so getitimer() can expose the two padding holes. Zero-initialize the aggregate before assigning the fields so implicit padding is deterministic before it crosses the user/kernel boundary. Severity: 0.0