Linux Kernel LTS Releases 5.10.262, 5.15.213, 6.1.180, 6.6.147, 6.12.100, and 6.18.41 Fix 16-Year-Old POSIX Timer UAF Race
Greg Kroah-Hartman released six coordinated Linux kernel stable versions this past Thursday, with every currently-supported longterm branch receiving the exact same critical patch. The fix targets a 16-year-old use-after-free vulnerability in the POSIX CPU timers subsystem caused by a race condition between sys_timer_delete() and non-leader exec() calls. Independently discovered by researchers Wongi Lee and Jungwoo Lee, the bug could silently disable timers or enable local privilege escalation on multi-threaded systems. Thomas Gleixner's four-part patch lands across all six branches, with 6.18.41 additionally picking up a preparatory callback update while stable maintainers continue merging dozens of branch-specific fixes behind the scenes.
Linux Kernel LTS Releases 5.10.262, 5.15.213, 6.1.180, 6.6.147, 6.12.100, and 6.18.41 Fix 16-Year-Old POSIX Timer UAF Race
Greg Kroah-Hartman released six coordinated stable versions of the Linux kernel, addressing a critical patch for a 16-year-old use-after-free vulnerability in the POSIX CPU timers subsystem. This vulnerability, caused by a race condition between sys_timer_delete() and non-leader exec() calls, could lead to timers being silently disabled or allow local privilege escalation on multi-threaded systems. The fix, authored by Thomas Gleixner, consists of a four-part patch that adds necessary release semantics and a new retry-based lookup helper to enhance thread safety. Users running these kernel versions are encouraged to update to ensure the stability and security of their systems, particularly those operating multi-threaded daemons or container runtimes
